Sophos Cloud Optix licensing

Subscriptions are based on the number of cloud assets in the cloud environments that you add to Sophos Cloud Optix.

Sophos Cloud Optix is a subscription-based SaaS service, and is available as follows:
  • Term license: purchased up front for a 12, 24 or 36 month term.
  • MSP Flex: for Managed Service Providers, billed monthly in-arrears based on usage.
  • Pay-as-you-go (PAYG) via AWS Marketplace: billed monthly in arrears based on usage, via your AWS bill.
  • If you have an Intercept X Advanced for Server with EDR term license, you can use Sophos Cloud Optix for EDR. To find out the differences between this and Sophos Cloud Optix see Sophos Cloud Optix for EDR.

You can add as many cloud environments (for example AWS Accounts, Azure Subscriptions, GCP Projects) as you need to a single Sophos Cloud Optix account.

Subscriptions may also include a maximum daily log data volume, where log data includes ingestion of network flow logs and activity logs. Add-on subscriptions are available for additional log data volumes.

Cloud asset means a single virtual machine instance, including any server instance or database instance, that runs in a cloud environment that benefits from, or whose configuration is accessed by Sophos Cloud Optix.

The following are currently considered as cloud assets:

  • AWS EC2
  • AWS RDS
  • Azure VM
  • Azure SQL Server
  • Azure DB Server
  • Azure Cosmos DB
  • Google VM
  • Google SQL
  • Kubernetes Nodes (to avoid duplication, these are not counted if they are already counted under AWS EC2 VM, Azure VM or GCP VM)

Usage reporting in Sophos Cloud Optix

A cloud asset is counted and reported in your console if it has been seen during the last 30 days.

When Sophos Cloud Optix connects to your cloud environment (for example an AWS account) the service records the number of cloud assets for that specific environment at that point in time. Sophos Cloud Optix records the highest number of cloud assets seen on any given day in the last 30 days, for each cloud environment. If there are multiple cloud environments on your account, these are added together and reported in your console as the usage.

Usage calculation for MSP Flex billing

MSP Flex billing is based on aggregate usage of Sophos Cloud Optix across multiple customers, billed monthly in arrears.

A cloud asset is counted and reported for billing if it's seen during 30 days prior to billing.

When Sophos Cloud Optix connects to a customer's cloud environment (for example an AWS account) the service records the number of cloud assets for that specific environment at that point in time. Sophos Cloud Optix records the highest number of cloud assets seen on any given day in the last 30 days, for each cloud environment. If there are multiple cloud environments on the customer's account, these are added together and reported as the usage for that customer. If the MSP has multiple Sophos Cloud Optix customers, the usage for each customer is aggregated for monthly billing.

The following table shows how usage recording works over a 30 day period. In this example the customer has three cloud environments (for example AWS accounts) in Sophos Cloud Optix.
Table 1. MSP Flex billing example

Instance

Cloud assets used during 30 day period

Number of cloud assets recorded

Environment #1

25 on one day

50

50 on another day

Environment #2

10 on one day

20

20 on another day

Environment #3

25 on one day

25

Zero usage on another day

In this example the total monthly usage for this customer is 95 cloud assets.

Usage calculation for PAYG via AWS Marketplace

Sophos Cloud Optix is available via AWS SaaS subscription on a pay-as-you-go (PAYG) basis. Billing is based on actual usage, calculated on an hourly basis, billed monthly in arrears. See the Sophos Cloud Optix (PAYG) page on AWS Marketplace.

Once you've signed up for Sophos Cloud Optix via AWS Marketplace and added your cloud environments to the service, Sophos Cloud Optix continuously monitors the number of cloud assets on your account and sends this information to AWS on an hourly basis. AWS calculates the total usage over the month and includes this in your monthly AWS bill.

You can cancel Sophos Cloud Optix PAYG SaaS subscriptions on AWS Marketplace at any time.

Sophos Cloud Optix for EDR

Sophos Cloud Optix for EDR is only available with term licenses for Intercept X Advanced for Server with EDR. It's not included with MSP Flex licenses for Intercept X Advanced for Server with EDR.

If you have a term license for Intercept X Advanced for Server with EDR, the number of cloud assets you can have in Sophos Cloud Optix for EDR depends on the number of servers you have in your Intercept X Advanced for Server with EDR license. You can have up to 120% of the number of servers.

For example, if you have 150 servers, you can have 180 cloud assets. This covers cloud assets that are counted for licensing by Sophos Cloud Optix that are not counted as servers, such as database instances. Your Sophos Cloud Optix for EDR entitlement and usage is displayed on the Sophos Cloud Optix dashboard.