Published 12 November 2026 · Rathish Kumar, Invitty
For a 10 to 120 user office, Sophos's second-generation XGS desktop firewalls and SonicWall's Gen 8 TZ range are close competitors. SonicWall's Gen 8 datasheet lists threat prevention from 1 Gbps on the TZ280 to 2.5 Gbps on the TZ680; Sophos lists 2 to 4.75 Gbps across the XGS 88 to 138. Those numbers are measured differently, so the choice usually comes down to management, remote access and three-year cost.
The published figures
| Sophos model | Threat protection | SonicWall model | Threat prevention |
|---|---|---|---|
| XGS 88 | 2 Gbps | TZ280 | 1 Gbps |
| XGS 108 | 2.5 Gbps | TZ380 | 1.5 Gbps |
| XGS 118 | 3.25 Gbps | TZ480 | 2 Gbps |
| XGS 128 | 4 Gbps | TZ580 | 2.2 Gbps |
| XGS 138 | 4.75 Gbps | TZ680 | 2.5 Gbps |
The pairs in each row are a rough match by position in each range, not an exact equivalence.
Read the footnotes before the headline
SonicWall is explicit about its method. Threat prevention is measured with Keysight HTTP test tools with gateway anti-virus, anti-spyware, IPS and application control switched on, and firewall inspection throughput follows RFC 2544. Sophos publishes its figures under its own conditions. Neither number includes decrypting HTTPS traffic, which is where small firewalls slow down most.
So treat the table as a way to shortlist, not to rank. A TZ480 and an XGS 108 will both carry a typical office on a 300 Mbps link. Whether either still does with full TLS inspection on is something to test, not assume.
Remote access and the recent SonicWall advisory
Many small offices buy these boxes mainly for VPN. If your team signs in through Microsoft Entra ID or Google using SAML, read our note on the SonicWall SSL-VPN SAML flaw added to CISA's exploited list in November 2026. It does not make SonicWall a bad choice, but it shows why firmware discipline matters more than the brand on the box. Sophos Firewall handles remote users through its Sophos Connect client. Whichever you pick, put MFA on every remote login and keep the firmware current.
Management and day-two work
SonicWall's Gen 8 TZ range runs SonicOS 8 and supports central management through Network Security Manager, along with the local web interface. Sophos manages its firewalls from Sophos Central, the same console as its endpoint products. If your laptops already run Sophos, the shared console is a strong reason to stay with Sophos. If you have a SonicWall estate and staff who know SonicOS, staying with SonicWall avoids a retraining cost that never shows up on a quote.
Where each one tends to fit
- Sophos XGS: offices already on Sophos endpoint, or that want one console for firewall and laptops.
- SonicWall Gen 8 TZ: existing SonicWall customers replacing older TZ hardware, and sites that want a low entry cost for a small branch.
- Either: plan the three-year subscription, not just the appliance price. That is where quotes differ most.
Next step
If you are replacing an older SonicWall or a Sophos XG, tell us the model and firmware and we will check its support status first. Then compare SonicWall TZ and Sophos XGS options on the same requirement, or start with the firewall sizing calculator.
Frequently asked questions
Is it worth replacing an older SonicWall TZ with a Gen 8 model?
Which brand is better for a 25-user office?
Do we need TLS inspection on a small office firewall?
Sources
Figures in this guide come from these vendor pages, checked on 12 November 2026. Vendors update datasheets, so confirm the current figures before you order.