Sophos Cloud Optix licensing

Subscriptions are based on the number of cloud assets in the cloud environments you add to Sophos Cloud Optix.

Sophos Cloud Optix is a subscription-based SaaS service and is available as follows:
  • Term license: purchased in advance for a 12, 24, or 36 month term.
  • MSP Flex: for Managed Service Providers, billed monthly in arrears based on usage.
  • Sophos Cloud Optix for EDR: if you have an Intercept X Advanced for Server with EDR term license, you can use Sophos Cloud Optix for EDR. To find out the differences between this and Sophos Cloud Optix, see Sophos Cloud Optix for EDR.
  • Pay-as-you-go (PAYG) via AWS Marketplace: billed monthly in arrears based on usage via your AWS bill.

You can add as many cloud environments (for example AWS Accounts, Microsoft Azure Subscriptions, GCP Projects) as you need to a single Sophos Cloud Optix account.

A cloud asset is a single virtual machine instance (including any server instance or database instance) or container image, within a cloud environment that benefits from, or whose configuration is accessed by, Sophos Cloud Optix.

For the purposes of this definition, a cloud environment is an environment facilitating or involved in the delivery of computing services over the internet, including but not limited to Amazon Web Services (AWS) accounts, Microsoft Azure subscriptions, Google Cloud Platform (GCP) projects, Kubernetes clusters, development code repositories, and container registries.

The following resource types are counted as cloud assets:

  • AWS

    • AWS EC2 instances in a running state
    • AWS RDS instances, excluding those in a stopped state
  • Microsoft Azure

    • Microsoft Azure VMs in a running state
    • Microsoft Azure SQL servers in a ready state
    • Microsoft Azure DB servers
    • Microsoft Azure Cosmos DB servers
  • Google Cloud Platform

    • Google VMs in a running state
    • Google DB servers in a runnable state
  • Kubernetes

    • Kubernetes Nodes.

      These aren't counted if they're already counted under AWS EC2, Microsoft Azure VM, or GCP VM, to avoid duplication.

  • Container images

    • Images in your container image registries count towards licensing once they've been scanned.

Usage reporting for trials and term licenses

For trials and term license accounts, the number of cloud assets detected by the most recent synchronization with each cloud environment is reported in your console.

Cloud assets from inactive environments aren't included in the usage count, but you may still see these assets in your inventory.

Usage reporting for MSP Flex

MSP Flex billing is based on aggregate usage of Sophos Cloud Optix across multiple end customers, billed to the MSP monthly in arrears.

A cloud asset is counted and reported for billing if it's seen during the 30 days before billing. The highest number of cloud assets seen on a single day in the last 30 days is reported for each of the MSP partner's customers in Sophos Central Partner.

For example, if a customer has 25 cloud assets on one day and 50 on another day, the number of cloud assets reported in Sophos Central Partner for the customer is 50.

Usage reporting for Sophos Cloud Optix for EDR

Sophos Cloud Optix for EDR is only available with term licenses for Intercept X Advanced for Server with EDR. It's not included with MSP Flex licenses for Intercept X Advanced for Server with EDR.

If you have a term license for Intercept X Advanced for Server with EDR, the number of cloud assets you can have in Sophos Cloud Optix for EDR depends on the number of servers you have in your Intercept X Advanced for Server with EDR license. You can have up to 120% of the number of servers.

For example, if your Intercept X Advanced for Server with EDR license allows up to 150 servers, you can have up to 180 cloud assets in Sophos Cloud Optix for EDR. This covers cloud assets counted for licensing by Sophos Cloud Optix that aren't counted as servers, such as database instances. The Sophos Cloud Optix dashboard displays your Sophos Cloud Optix for EDR entitlement and usage.

If you need more cloud assets, you can either increase your Intercept X Advanced for Server with EDR license entitlement, or buy a full license for Sophos Cloud Optix.

Usage reporting for Sophos Cloud Optix PAYG via AWS Marketplace

Sophos Cloud Optix is available via AWS SaaS subscription on a pay-as-you-go (PAYG) basis. Billing is based on actual usage, calculated on an hourly basis, billed monthly in arrears. See Sophos Cloud Optix (PAYG) on AWS Marketplace.

Sign up for Sophos Cloud Optix via AWS Marketplace and add your cloud environments to the service. Sophos Cloud Optix continuously monitors the number of cloud assets on your account and sends this information to AWS on an hourly basis. AWS calculates the total usage over the month and includes this in your monthly AWS bill.

You can use a free usage tier available via AWS Marketplace. If you use this, you're only billed for usage above the free tier.

You can cancel Sophos Cloud Optix subscriptions on AWS Marketplace at any time.