Sophos Cloud Optix licensing

Subscriptions are based on the number of cloud assets in the cloud environments you add to Sophos Cloud Optix.

Sophos Cloud Optix is a subscription-based SaaS service and is available as follows:
  • Term license: purchased in advance for a 12, 24, or 36 month term.
  • MSP Flex: for Managed Service Providers, billed monthly in arrears based on usage.
  • Sophos Cloud Optix for EDR: if you have an Intercept X Advanced for Server with EDR term license, you can use Sophos Cloud Optix for EDR. To find out the differences between this and Sophos Cloud Optix, see Sophos Cloud Optix for EDR.
  • Pay-as-you-go (PAYG) via AWS Marketplace: billed monthly in arrears based on usage via your AWS bill.

You can add as many cloud environments (for example AWS Accounts, Microsoft Azure Subscriptions, GCP Projects) as you need to a single Sophos Cloud Optix account.

A cloud asset is a single virtual machine instance, including any server instance or database instance, running in a cloud environment that benefits from, or whose configuration is accessed by, Sophos Cloud Optix.

The current list of resource types that are counted as cloud assets is as follows:

  • AWS

    • AWS EC2 instances in a running state
    • AWS RDS instances, excluding those in a stopped state
  • Microsoft Azure

    • Microsoft Azure VMs in a running state
    • Microsoft Azure SQL servers in a ready state
    • Microsoft Azure DB servers
    • Microsoft Azure Cosmos DB servers
  • Google Cloud Platform

    • Google VMs in a running state
    • Google DB servers in a runnable state
  • Kubernetes

    • Kubernetes Nodes.

      To avoid duplication, these aren't counted if they're already counted under AWS EC2, Microsoft Azure VM or GCP VM.

Usage reporting for trials and term licenses

For trials and term license accounts, the number of cloud assets detected by the most recent security scan of each cloud environment is reported in your console.

If an environment hasn't been scanned within the last month, assets for that environment aren't included in the usage count.

Usage reporting for MSP Flex

MSP Flex billing is based on aggregate usage of Sophos Cloud Optix across multiple end customers, billed to the MSP monthly in arrears.

A cloud asset is counted and reported for billing if it's seen during the 30 days before billing. The highest number of cloud assets seen on a single day in the last 30 days is reported for each of the MSP partner's customers in Sophos Central Partner.

For example, if a customer has 25 cloud assets on one day and 50 on another day, the number of cloud assets reported in Sophos Central Partner for the customer is 50.

Usage reporting for Sophos Cloud Optix for EDR

Sophos Cloud Optix for EDR is only available with term licenses for Intercept X Advanced for Server with EDR. It's not included with MSP Flex licenses for Intercept X Advanced for Server with EDR.

If you have a term license for Intercept X Advanced for Server with EDR, the number of cloud assets you can have in Sophos Cloud Optix for EDR depends on the number of servers you have in your Intercept X Advanced for Server with EDR license. You can have up to 120% of the number of servers.

For example, if your Intercept X Advanced for Server with EDR license allows up to 150 servers, you can have up to 180 cloud assets in Sophos Cloud Optix for EDR. This covers cloud assets counted for licensing by Sophos Cloud Optix that aren't counted as servers, such as database instances. The Sophos Cloud Optix dashboard displays your Sophos Cloud Optix for EDR entitlement and usage.

If you need more cloud assets, you can either increase your Intercept X Advanced for Server with EDR license entitlement, or buy a full license for Sophos Cloud Optix.

Usage reporting for Sophos Cloud OptixPAYG via AWS Marketplace

Sophos Cloud Optix is available via AWS SaaS subscription on a pay-as-you-go (PAYG) basis. Billing is based on actual usage, calculated on an hourly basis, billed monthly in arrears. See the Sophos Cloud Optix (PAYG) page on AWS Marketplace.

Sign up for Sophos Cloud Optix via AWS Marketplace and add your cloud environments to the service. Sophos Cloud Optix continuously monitors the number of cloud assets on your account and sends this information to AWS on an hourly basis. AWS calculates the total usage over the month and includes this in your monthly AWS bill.

You can use a free usage tier available via AWS Marketplace. If you use this, you are only billed for usage above the free tier.

You can cancel Sophos Cloud Optix subscriptions on AWS Marketplace at any time.