What is included in Sophos Intercept X Advanced for Server with XDR?

Sophos Central console – Cloud console for policies, alerts and server deployment.
CryptoGuard ransomware rollback – Detects malicious encryption and restores the affected files automatically.
Deep learning prevention – Blocks unknown malware on Windows Server and Linux hosts.
Sophos Data Lake – 90 days of detection data for later investigation work.
Live Response terminal – Remote command line on Windows, Linux and macOS devices.
Important – Disk encryption, patch management and backup are not included.

What are the main benefits of Sophos Intercept X Advanced for Server with XDR?

Sophos Intercept X Advanced for Server with XDR is a server workload protection subscription for Windows Server and Linux, managed entirely from the Sophos Central cloud console with no on-premises management server. Sophos renamed the product from Intercept X Advanced for Server with EDR in July 2021, and the Corporate designation in the retail name identifies the commercial business variant rather than the education or government one.

One agent – Same installer for on-premises, virtual and cloud servers.
Exploit prevention – More than 60 mitigations against fileless attack techniques.
File integrity monitoring – Flags changes to critical system files on Windows Server.
Application lockdown – Only approved applications are allowed to run.
Third-party telemetry – XDR correlates data from non-Sophos products and services.
Forensic data export – Exports incident data for auditors, insurers or external responders.

Best antivirus? Why Windows Defender alone is not enough
Explains where the protection built into Windows stops and what a dedicated security product adds on top of it.

Which company size is Sophos Intercept X Advanced for Server with XDR suitable for?

The deciding factor is not headcount but whether someone in the organisation will actually look at detections. XDR produces prioritised detections, threat graphs and queryable data; if nobody reviews them, you are paying for a data lake that no one opens. Companies without that capacity should either add the managed service or stay on the edition without XDR.

Does Sophos Intercept X Advanced for Server with XDR meet the requirements of Swiss cybersecurity legislation?

No software makes an organisation compliant with Swiss law, and this product is no exception. Since 1 April 2025 the revised Information Security Act (ISG) obliges operators of critical infrastructure, including energy and water suppliers, transport companies, listed hospitals and cantonal and communal administrations, to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery, with a further 14 days to complete the report. What this product contributes to that deadline is detection and evidence: server detections are mapped to the MITRE ATT&CK framework automatically, threat graphs show the root cause of how an attack reached a server, and 90 days of data in the Sophos Data Lake mean the sequence of events can still be reconstructed after a server has been wiped and rebuilt. What it does not do is judge whether an incident is reportable, prepare the BACS notification, or cover anything outside the server estate, since workstations, mailboxes, firewalls and mobile devices each need their own licence and feed their own telemetry. This text is not legal advice; whether your organisation falls under the reporting obligation should be clarified with your own legal counsel.

Does Sophos Intercept X Advanced for Server with XDR meet the requirements of European cybersecurity legislation?

No product creates NIS 2 compliance, because the directive addresses organisational measures, management accountability and reporting rather than any single tool. NIS 2 requires measures in categories including risk analysis and information system security, incident handling, business continuity and backup management, supply chain security, and the use of cryptography. This product contributes to incident handling through detection, investigation, isolation of a compromised server and remote response, and to the technical hardening side of information system security on server workloads specifically. It contributes nothing directly to business continuity and backup management, nothing to supply chain security, and cryptography is covered only if Sophos Device Encryption is licensed separately, since it is an add-on rather than part of this subscription. The governance duties the directive places on company leadership, including approval and oversight of the risk measures, stay organisational work that no security agent performs for you.

Does Sophos Intercept X Advanced for Server with XDR help with security questionnaires from large customers?

Yes, for roughly the endpoint and logging half of a typical questionnaire, and not at all for the rest. It answers questions on malware protection for servers, behavioural and exploit detection, central policy management, role-based administrative access, retention of security-relevant data for 90 days, evidence of file integrity monitoring on Windows Server, and the ability to isolate a compromised host and export forensic data on request. It does not answer questions on patch and vulnerability management, disk encryption, backup and restore testing, multi-factor authentication, mail filtering, or 24/7 monitoring coverage, and a questionnaire that asks for a monitored service will not accept a self-managed console as an equivalent answer. The cheaper route for most of those gaps is to stay inside the same family rather than mixing vendors: Sophos MDR covers the 24/7 monitoring item, Sophos Device Encryption covers the encryption item, and both attach to the same Sophos Central account and the same reports, which means one console screenshot instead of three when the auditor asks for proof.

Data loss is expensive: How backups help you avoid outages
Covers why ransomware rollback on a server is not the same thing as a tested backup, and what a working restore process needs.

What is the difference between Intercept X Advanced for Server and Intercept X Advanced for Server with XDR?

The decisive difference is what survives the incident: without XDR there is no Sophos Data Lake, so once a compromised server is reinstalled the evidence is gone. Both editions run the same protection engine, so ransomware rollback, deep learning malware prevention and exploit prevention are identical in each. XDR adds the queryable 90-day data store, the remote command line for responding to a live incident, the ingestion of data from non-Sophos products, and forensic export. Neither edition includes a managed service, which is a separate Sophos MDR subscription in both cases.

Which limitations should you know before buying?

There is no Swiss Sophos Central data region. The region is chosen once when the Sophos Central account is created and cannot be changed afterwards, and the European options are Germany and Ireland, which means Swiss buyers with a strict in-country data requirement need to clear that point before rollout rather than after. Several capabilities are Windows Server only, including file integrity monitoring, application lockdown, exploit prevention and forensic data export, so a Linux-heavy estate gets detection, deep learning malware prevention and remote response but not the full Windows feature set. Each protected device can upload a maximum of 2 GB of data per day to the Data Lake and stops uploading until the limit resets, which matters on busy database and file servers running broad queries. The follow-up purchases this product most often triggers are disk encryption, a managed service for out-of-hours coverage, and a separate endpoint licence, since workstations and laptops are not covered by a server subscription.

End of Support for Windows Server 2022: Windows Server 2025 vs. 2022 vs. 2019: Is It Worth Upgrading?
Compares the current Windows Server versions and their support dates, which decides how long your servers can stay on a supported protection agent.

Frequently asked questions about Sophos Intercept X Advanced for Server with XDR

Does this licence also cover desktops and laptops?

No. This subscription covers Windows Server and Linux workloads only. Desktops, laptops and Mac clients need a separate endpoint subscription, although both are managed side by side in the same Sophos Central console.

Does it protect containers as well as the host?

Yes, on Linux. The agent provides behavioural and exploit detections inside container runtimes including Docker, containerd and CRI-O, aimed at container escapes, kernel exploits and privilege escalation, and it runs without requiring a kernel module.