Sophos ZTNA
Sophos ZTNA controls user access to private applications while keeping those applications invisible to outsiders.
What Sophos ZTNA is
Sophos ZTNA controls user access to private applications while keeping those applications invisible to outsiders. Its zero-trust access policies can evaluate device posture and block compromised devices, using Sophos Security Heartbeat from Sophos Endpoint for that signal. The product is positioned for remote and hybrid workers as a replacement for legacy remote-access VPNs. Supported environments include Windows, macOS, web, VMware ESXi, Hyper-V, and Sophos Firewall. Gateways run on VMware ESXi 7+, Hyper-V 2016+, or Sophos Firewall; Sophos specifies up to 10,000 agent connections per gateway node and up to 90,000 across clusters of up to nine nodes. Identity providers include on-premises Microsoft Active Directory, Microsoft Entra ID, and Okta, with SSO and SCIM support. Administrators receive advanced controls and audit logs, and management is included in Sophos Fusion. Pricing is on request, with a 30-day free trial.
Good
- Device posture can block compromised devices
- Supports Windows, macOS, and web
- Includes SSO and SCIM
- Provides audit logs
- Offers a 30-day free trial
Watch out
- Pricing requires a quote
- No site-to-site networking
- Gateway deployment needs supported infrastructure
- Agent support is limited to listed operating systems
Who it suits
It suits organizations managing remote or hybrid access to private applications across desktop and web environments. Teams needing device posture checks, identity integration, and audit logs may find the controls relevant.
Verdict
Sophos ZTNA focuses on controlled application access rather than site networking. Its posture checks, identity options, gateway capacity, and centralized management fit organizations replacing legacy remote access.
Plans and prices
From Sophos ZTNA's own pricing page, checked 11 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Sophos Workspace Protection (includes Sophos ZTNA) | Priced on request | per-user termed license; MSP monthly option · quote required · bundle includes Protected Browser, Extension, ZTNA, endpoint DNS protection, Email Monitoring System, and Sophos Fusion |
The facts
Each one read from Sophos ZTNA's own pages, with the date it was checked.
What it does
- Access model
- ztnachecked 22 Sep 2026
- Access security
- Access policies can use device posture to block compromised devices from connecting.checked 11 Oct 2026
- Admin control level
- advancedchecked 22 Sep 2026
- Audit logs
- Yeschecked 22 Sep 2026
- Gateway capacity
- Sophos specifies up to 10,000 agent connections per gateway node and up to 90,000 across a cluster of at most nine nodes.checked 11 Oct 2026
- Gateway deployment
- ZTNA Gateway runs on VMware ESXi 7+, Hyper-V 2016+, or Sophos Firewall.checked 11 Oct 2026
- Identity providers
- The listed identity providers for ZTNA are Microsoft Active Directory on premises, Microsoft Entra ID, and Okta.checked 11 Oct 2026
- Licensing
- Workspace Protection, which includes ZTNA, is sold standalone per user on a termed license or monthly through managed service providers; pricing is by quote.checked 11 Oct 2026
- Management
- Sophos Fusion provides a unified cloud management console with real-time information sharing and automated incident response, and it includes ZTNA management.checked 11 Oct 2026
- Product role
- Sophos ZTNA securely connects users to only the applications they need while making private applications invisible to the outside world.checked 11 Oct 2026
- Remote workforce
- Sophos describes ZTNA as a replacement for legacy remote access VPN for remote and hybrid workers.checked 11 Oct 2026
- Site-to-site networking
- Nochecked 22 Sep 2026
- SSO / SCIM
- Yeschecked 22 Sep 2026
Where it runs
- Agent platforms
- The ZTNA Agent supports Windows 10 and 11 on Intel and ARM, plus macOS Sonoma, Sequoia, and Tahoe on Intel and Apple processors.checked 11 Oct 2026
- Device posture
- Yeschecked 22 Sep 2026
- Device posture integration
- ZTNA Agent device posture uses Sophos Security Heartbeat from Sophos Endpoint.checked 11 Oct 2026
- Protected Browser
- ZTNA integrates with Sophos Protected Browser, which includes an RDP and SSH client for application and system access.checked 11 Oct 2026
- Supported platforms
- Windows,macOS,web,VMware ESXi,Hyper-V,Sophos Firewallchecked 22 Sep 2026
The company
- Company
- Sophos says it delivers AI-native cybersecurity and reports more than 625,000 global customers.checked 11 Oct 2026
- Company history and location
- A Sophos company profile states it was founded in Oxford, England in 1985; Sophos Limited lists its registered office in Abingdon, United Kingdom.checked 11 Oct 2026
- Founded
- 1985checked 4 Oct 2026
Money
- Trial
- Sophos offers a free, no-obligation 30-day trial of Workspace Protection.checked 11 Oct 2026
Alternatives to Sophos ZTNA
- 1
Tailscale
Free planOpen sourceAndroidiOSWebAPI9.4From $1 a month - 2
Windscribe
Free planOpen sourceAndroidiOSWebExtension9.1From $3 a month - 3
NetBird
Free planAndroidiOSLinuxmacOS9.0From €6 a month - 4
Twingate
Free planAndroidiOSWebAPI8.9From $5 a month - 5
GoodAccess
Free planAndroidiOSWebLinux8.8Free plan - 6
ZeroTier
Free planAndroidiOSWebAPI8.8From $18 a month