Home | Partners | Sophos partner | Sophos Workspace Protection
Sophos Workspace Protection
Sophos Workspace Protection is a bundle that secures remote and hybrid staff, combining zero trust network access, a protected browser, and DNS protection in one licence. It is how your people reach company applications and the web safely from anywhere, without a traditional VPN. 4iT deploys and manages it as part of the Sophos platform for Sydney businesses with staff working outside the office.
Sydney MSP
Greater Sydney, NSW
- Microsoft Partner
- Sophos Partner
- Ubiquiti Partner
ZTNA
zero trust replaces legacy VPN
Device health
compromised laptops blocked from connecting
Key facts
- Sophos Workspace Protection bundles ZTNA, the Sophos Protected Browser, and DNS protection for remote and hybrid staff.
- It replaces standalone Sophos ZTNA, which is no longer sold separately as of early 2026.
- Zero trust access gives users only the specific applications they need, not the whole network.
- A ZTNA gateway is built into every Sophos Firewall, so there is no extra hardware to deploy.
- Access decisions can factor in device health, so a compromised laptop is blocked from connecting.
What is zero trust network access, in plain terms?
Zero trust network access (ZTNA) gives a user access to the specific applications they need and nothing else, instead of dropping them onto the whole network the way a VPN does. The practical difference is your attack surface. With a VPN, a compromised laptop is inside your network. With ZTNA, that same laptop can only reach the handful of apps its user is allowed, and only if the device is healthy. It is least-privilege access applied to remote work.
Why move off a traditional VPN?
VPNs were designed for a world where remote access was the exception, not the default. They expose the whole network, they are clumsy to manage at scale, and they do not check whether the connecting device is actually safe. Workspace Protection replaces that with access tied to the user and the device’s health, which is both more secure and, once set up, easier for staff to use. (The honest catch: moving off a VPN takes planning, so we phase it rather than flipping a switch.)
How does this fit with the rest of Sophos?
Workspace Protection shares device health with Sophos Endpoint and the Sophos Firewall through Synchronized Security, so access automatically tightens when a threat is detected. It is managed from Sophos Central like everything else. If you want the wider thinking behind this approach, our explainer on what zero trust means for Australian SMEs sets the context.
Frequently Asked Questions
No. We usually run Workspace Protection alongside an existing VPN at first, move applications across in stages, and retire the VPN once everything is migrated. A phased approach avoids locking anyone out mid-transition.
Sophos folded standalone ZTNA into Workspace Protection in early 2026, and existing ZTNA customers are being upgraded to the bundle. If you already run Sophos ZTNA, we will manage that transition for you.
Yes, though device health checks are stronger on managed devices. We help you set sensible access policies for personal devices, balancing security with the reality that people do sometimes work from a home laptop.
If your remote access is still a VPN you do not fully trust, there is a better way. Call 4iT on 1800 367 448 and we will map out the move.
Ready to Talk to a Sydney IT Specialist?
4iT Support covers SMEs across Greater Sydney including the Hills District, North Shore, Parramatta, and the CBD. No lock-in contracts. Straight answers.