Published 12 November 2026 · Rathish Kumar, Invitty
For a 25 to 150 user office in India, both Fortinet's FortiGate G-series and Sophos's second-generation XGS desktop firewalls will do the job. The differences that matter are how each vendor measures throughput, how remote access works on the smaller models, and who will run the box after go-live. Below is the comparison we walk customers through, using each vendor's own figures as of November 2026.
What the two datasheets say, side by side
These are the desktop models we quote most often for small and mid-sized offices. Fortinet's figures come from its November 2026 product matrix; Sophos's come from its page for the second-generation XGS desktop range.
| Model | Firewall throughput | Threat protection throughput | Vendor's test basis |
|---|---|---|---|
| FortiGate 50G | 5 Gbps | 1.1 Gbps | Enterprise traffic mix, firewall + IPS + app control + malware |
| FortiGate 70G | 10 Gbps | 1.3 Gbps | Same as above |
| FortiGate 90G | 28 Gbps | 2.2 Gbps | Same as above |
| FortiGate 120G | 39 Gbps | 2.8 Gbps | Same as above |
| Sophos XGS 88 | 9.9 Gbps | 2 Gbps | Sophos published figure |
| Sophos XGS 108 | 12.5 Gbps | 2.5 Gbps | Sophos published figure |
| Sophos XGS 118 | 15.5 Gbps | 3.25 Gbps | Sophos published figure |
| Sophos XGS 128 | 19.1 Gbps | 4 Gbps | Sophos published figure |
Why you cannot compare those columns directly
On paper the Sophos XGS 108 looks twice as strong as a FortiGate 70G at threat protection. In practice that conclusion is unsafe. Fortinet states exactly what its threat protection number includes: firewall, IPS, application control and malware protection, measured on an enterprise traffic mix. Sophos publishes its own figure under its own test conditions. Two vendors, two methods, two numbers that were never meant to sit in the same column.
There is a second trap. Neither threat protection figure includes decrypting HTTPS, and today most office traffic is encrypted. Fortinet lists SSL inspection separately: 1.4 Gbps on the 70G and 2.6 Gbps on the 90G. If you plan to inspect encrypted traffic, size on that figure, not the headline one.
Our advice is simple. Shortlist one model from each brand that comfortably clears your internet bandwidth, then ask for a short proof of concept on your own links with the features you will actually switch on. A week of real traffic tells you more than any datasheet.
Remote access changes the shortlist
This is the point most buyers miss. Fortinet's November 2026 matrix shows no SSL VPN figure for the FortiGate 30G, 40F, 50G, 60F or 70G, while it does list SSL VPN for larger models such as the 90G. If your staff connect from home today using SSL VPN, plan the move to IPsec VPN with FortiClient before you buy a small FortiGate, or choose a model where your current method is supported.
Sophos Firewall supports remote access through its Sophos Connect client. Either way, list your remote users and how they connect before you compare prices. It is a much cheaper conversation before the order than after.
Management, integration and the team that runs it
A firewall is only as good as the person changing its rules eighteen months from now. Sophos Firewall is managed from Sophos Central, the same console that runs Sophos endpoint protection. If your laptops already run Intercept X, that shared console and the link between endpoint and firewall are a genuine advantage.
FortiGate rewards teams that want detailed control and plan to grow the Fortinet estate. Its SD-WAN is built in, and FortiSwitch and FortiAP can be managed from the same FortiGate. For a business with three or more branches on mixed broadband and leased lines, that matters more than a few hundred megabits on a datasheet.
Renewals: the second-year bill
Both vendors sell security services as subscriptions on top of the appliance. The hardware is a one-time cost; the subscription is what you pay every year. When you compare quotes, ask for three years of the same service level on both, itemised with GST, and check what happens if a renewal lapses. Our licence renewal desk tracks expiry dates so the firewall does not quietly stop updating its signatures.
How we would choose for a 50 to 150 user office
- Already on Sophos endpoint, single site: lean towards XGS 108 or 118 for the shared console.
- Several branches or SD-WAN on the roadmap: lean towards FortiGate 70G or 90G.
- Heavy HTTPS inspection planned: size on the SSL inspection figure and go one model up if you are close.
- Remote staff on SSL VPN today: settle the remote access method first, then pick the model.
Next step
Send us your user count, internet links and current firewall, and we will size one FortiGate and one Sophos model against the same requirement, with both quotes itemised the same way. Start with the firewall sizing calculator, or see our FortiGate and Sophos Firewall pages.
Frequently asked questions
Is Sophos XGS faster than FortiGate because its numbers are higher?
Which is easier to manage for a small IT team?
Can we move from Sophos to FortiGate or the other way without downtime?
Sources
Figures in this guide come from these vendor pages, checked on 12 November 2026. Vendors update datasheets, so confirm the current figures before you order.