A consultant has recommended replacing our Fortinet firewalls and Microsoft Defender for Endpoint with Sophos. Defender is already included in our Microsoft 365 licensing for client devices, and we are buying additional server licenses.
The current setup works well. What would justify the switch, and how should we check Sophos support for non-persistent VDI?
Ask for the business case before comparing product features. What problem does the current setup leave unsolved, and how would the proposed change fix it?
Have the consultant break down firewall and endpoint costs separately, including licenses, migration work, support and the Microsoft coverage you already have. Also ask whether the consultant or their company resells Sophos. That does not invalidate the recommendation, but it is useful context.
Defender's integration with the Microsoft environment is a real reason to pause, especially since client coverage is already included. Paying for another endpoint product needs a clear benefit, not just a preference for a different console.
Check the details of your existing license and server purchases, then compare the actual capabilities you use against what Sophos would replace. A second endpoint license could be worthwhile for a specific requirement, but that requirement should be explicit.
There is a potential integration benefit on the Sophos side too. Its firewall and endpoint products can work together to restrict connectivity when the endpoint agent is not active and generate an alert. Ask for a demo using your own access requirements, then compare it with what your existing tools can do.
For non-persistent VDI, don't accept a simple yes as the whole answer. Get the supported deployment steps for your VDI platform and test them on a representative pool.
Check how the agent behaves in the base image and on cloned sessions, whether devices show up correctly in the console, and what happens when sessions are refreshed. Include performance and alerting in the test. Ask the vendor how updates and device identities should be handled for that setup.
Evaluate the firewall and endpoint proposals independently. Replacing a working firewall is a separate migration with its own rules, VPNs and support needs. Some feedback on Sophos firewall usability and support has been negative, so ask for a hands-on evaluation and test the support process before committing.
Answers are reviewed before publication.
y504+datagate_3:
Make sure the demo covers exceptions and recovery too. Blocking a device is only useful if the team can diagnose and restore access without creating a bigger outage.