Sophos UTM end of life: what to replace it with (Sophos Firewall, FortiGate or WatchGuard)

The short answer: Sophos UTM 9 and the SG appliance range have been end of life since 30 June 2026. There are no more system updates or security patches, protection stops when the licence expires, and Sophos states that no support will be provided to any customer beyond 31 December 2026. If a UTM still protects your network, replacing it is no longer a question of “if” but “when”. There are three serious paths: Sophos Firewall on an XGS appliance, the migration Sophos proposes, a Fortinet FortiGate, or a WatchGuard Firebox.

Let us be transparent about where we stand. ALLSAFE SOLUTIONS is a Fortinet integrator in Morocco and a WatchGuard partner in Morocco. We are not a Sophos partner and we do not sell Sophos products. If you are happy with Sophos, staying with that vendor by moving to Sophos Firewall can absolutely be the right choice: we explain why below, and a Sophos partner can take you down that path. The Sophos facts quoted here come only from its official publications (sophos.com, docs.sophos.com, community.sophos.com).

What Sophos announced

Sophos published the UTM end-of-life schedule in March 2023, which gave businesses more than three years to prepare. The milestones that matter today:

Milestone	What Sophos says
End of life (EOL) of Sophos UTM 9 and SG appliances	30 June 2026; Sophos’s migration page speaks of end of life “from July 1, 2026”
UTM licences	UTM (SG) SKUs are deactivated and term extensions are no longer possible
Protection features	They stop working when the licence expires
System updates	No further updates to the UTM operating system, and no patches if vulnerabilities are found
Support	No support for any customer beyond 31 December 2026
Replacement recommended by Sophos	Sophos Firewall, notably on XGS appliances

One point deserves emphasis: even if your UTM licence still runs for a few months, 31 December 2026 remains the limit. Sophos specifies that protection begins to degrade after that date. A licence paid until 2027 does not extend the life of the product.

What actually happens on a UTM still in service

On the day itself, nothing switches off. That is exactly what makes end of life dangerous: the appliance keeps routing traffic, VPNs stay up, users notice nothing. Behind the scenes, however:

• the system is no longer patched: a vulnerability found tomorrow in the VPN portal or the admin interface will never be fixed;
• signatures stop arriving when the licence expires: gateway antivirus, intrusion prevention, web filtering and anti-spam no longer know about new threats;
• nobody answers on the vendor side in case of failure or incident, at the latest after 31 December 2026.

A firewall is, by definition, exposed to the internet. End-of-life edge devices, and their VPN portals in particular, are a classic target for attackers. We recommend treating a UTM still in production as a risk to close as a priority, with a fixed cut-over date, rather than as something for “next year’s budget”.

The three possible replacements

Criterion	Sophos Firewall (XGS)	FortiGate (Fortinet)	WatchGuard Firebox
Continuity with what you have	Same vendor, migration proposed by Sophos	Change of vendor	Change of vendor
Configuration migration tooling	UTM migration utility and Sophos Firewall Config Studio	Rules reviewed and rewritten; Fortinet also publishes a conversion tool, FortiConverter	Rules reviewed and rewritten
Cloud console	Sophos Fusion (formerly Sophos Central)	FortiGate Cloud, or FortiManager for large estates	WatchGuard Cloud
Recognised strength	Exchange with Sophos Endpoint (Synchronized Security), support for RED devices	SD-WAN, network ecosystem (FortiSwitch, FortiAP)	Ease of administration, AuthPoint MFA
Our expertise	We do not deploy Sophos	Partner: deployment and monitoring	Partner: deployment and monitoring

None of these is a bad choice for an SMB. The right one depends on what your UTM really did, who will run the replacement, and what you already use around it.

Staying with Sophos: when it is the right choice

It needs saying plainly: Sophos Firewall is not simply “UTM version 10”. It is a different system (SFOS), with a different, zone-based rule logic. Migration therefore needs real preparation, even when staying with the same vendor. But it has genuine strengths:

• Sophos provides a tooled path: a migration utility, run on the UTM, converts a large part of the configuration (objects, services, rules, address translation, static routes), then Sophos Firewall Config Studio helps check the result, map interfaces to the new appliance’s ports and identify items to redo by hand before import;
• existing RED devices remain supported on Sophos Firewall, according to Sophos’s migration page;
• if your endpoints already run Sophos Endpoint, the firewall and the endpoint protection exchange information (Synchronized Security) to isolate a compromised computer automatically. Changing firewall vendor would lose that integration.

If this is your situation and you are happy with Sophos, staying is probably the most consistent choice. Work with a Sophos partner; we remain happy to give an independent opinion on the network architecture.

Changing vendor: when it makes sense

End of life is also a natural moment to reconsider the choice, since you have to change hardware and rewrite part of the configuration anyway. The cases where we see businesses move to FortiGate or WatchGuard:

• several sites to connect, with multiple carrier links and IP telephony to prioritise: FortiGate’s SD-WAN is a recognised strength, covered in FortiGate for SMBs: which model to choose;
• an SMB without a network team, wanting a readable console and MFA everywhere: WatchGuard Cloud and AuthPoint fit that need well, see our WatchGuard Firebox guide for SMBs;
• switches and WiFi to renew at the same time, where the Fortinet ecosystem simplifies administration;
• the need for a local provider that installs, monitors and comes on site, anywhere in Morocco from Casablanca.

To decide between these two vendors, read our comparison FortiGate or WatchGuard: which firewall for an SMB. For a direct comparison with the path Sophos proposes, see Sophos Firewall or FortiGate and Sophos or WatchGuard.

The inventory to do before choosing

Many UTMs do far more than firewalling. Before comparing quotes, list what yours actually handles, because each function needs a replacement:

• Firewall and address translation: rules, published servers, port forwards.
• VPN: site-to-site IPsec tunnels, remote access for home workers, user portal.
• Web server protection (Webserver Protection): if the UTM acts as a reverse proxy in front of a website, an extranet or mail, plan the equivalent, on the firewall or elsewhere.
• Email protection: if the UTM filters inbound mail, check what replaces it, especially as many businesses have moved to Microsoft 365 or Google Workspace in the meantime.
• Web filtering: blocked categories, exceptions, user authentication.
• RED devices and WiFi access points managed by the UTM.
• Authentication: Active Directory or LDAP, local accounts, one-time passwords.
• Logs and reports you need for your audits.

This inventory often reveals rules nobody uses any more, forgotten server publications and VPN accounts of former staff. It is the moment to remove them.

Our migration method to FortiGate or WatchGuard

1. UTM audit: configuration export, inventory of the functions above, log review to see which rules are really used.
2. Sizing the new appliance on throughput with inspection enabled, not raw firewall throughput, as explained in our business firewall buying guide for Morocco.
3. Rewriting the rules in the new vendor’s logic, with network segmentation (endpoints, servers, telephony, guests) rather than a line-by-line copy.
4. Preparation off production: the new appliance is configured and tested before cut-over, site VPNs and remote access included, with MFA.
5. Planned cut-over outside working hours, with a rollback option: the old UTM stays ready to be reconnected during validation.
6. Acceptance testing: browsing, email, telephony, each site’s VPN, business applications, remote workers’ access.
7. Handover to operations: monitoring, configuration backup, firmware update schedule and licence renewal tracking.

The approach is the same one we follow to migrate from pfSense to FortiGate: the value lies in the review, not in automatic conversion.

Mistakes we fix

1. Keeping the UTM “a bit longer” because it works, with no cut-over date.
2. Comparing quotes without an inventory: the replacement does not cover the web server or email protection the UTM provided.
3. Copying rules as they are, including “allow all” rules added years ago as a quick fix.
4. Forgetting remote workers: new VPN client to install, new credentials, MFA to enrol.
5. Sizing on raw throughput, then disabling inspection because everything slows down.
6. No rollback plan on cut-over night.

How we work

We start with a free initial audit of your UTM: configuration, functions in use, real traffic, remote access. We then give you a reasoned recommendation. If the conclusion is that Sophos Firewall is the right choice for you, we tell you so and point you to a Sophos partner. If FortiGate or WatchGuard fits better, we supply the hardware and licences, with or without installation, and handle the migration, cut-over and acceptance testing. Once in service, the firewall can be covered by our 24/7 monitoring, with critical incidents handled in under 15 minutes. All of this is part of our cybersecurity in Morocco offering, delivered from Casablanca across the country.

Is your Sophos UTM still in production? Request your free initial audit: we reply within 24 business hours.