Looking at these two for a 100-user office with heavy VPN traffic? You're comparing two very different licensing and cost models. The hardware is almost secondary.
Sophos will get you on the recurring costs. Their "Xstream Protection" stack is a mandatory bundle. You pay for every module whether you use it or not. Need just the firewall and VPN? Too bad. The per-user VPN licensing can also spiral with 100 users. Their support is a separate, expensive line item. True TCO over 3-5 years is often double the sticker price.
FortiGate's licensing is more modular, but their firmware upgrade path is a trap. Miss a renewal and you're stuck, potentially unable to update for security flaws. Their VPN client is free, which matters for heavy use. But the 100F might be undersized if you're pushing full tunnel VPNs with inspection for all users. You'll need to size up, which changes the cost comparison.
Don't just look at throughput specs. Look at the cost per concurrent VPN tunnel and the bandwidth with all services enabled. Both vendors hide the performance hit there.
I'm a sysadmin at a 250-person engineering firm. We migrated from Sophos SG to FortiGate 100Fs last year. Our stack is all on-prem with a heavy mix of site-to-site and user VPN traffic.
1. **Real VPN Throughput:** Don't trust the datasheet. With full threat inspection on, our 100F handles about 300 Mbps for IPsec VPN traffic. For 100 users, that's fine for general work. If you're moving large files over VPN daily, you'll need a 200F. Sophos XGS performance was similar per-dollar, but dropped more with their full bundle enabled.
2. **Licensing Trap Comparison:** OP is correct. Sophos's bundled license was $4,200/year for us, covering things we didn't use. FortiGate's UTP bundle was around $3,000/year, but we could drop to just FortiCare support (~$700) after the first year. Fortinet's "must renew to update firmware" is real, but we budget for it.
3. **VPN Client Cost:** This is a major factor. Sophos SSL VPN client requires a per-user license. At 100 users, that's a recurring line item. FortiGate's FortiClient VPN-only is free, no limit. This saved us over $2k/year immediately.
4. **Operational Overhead:** FortiGate's CLI and logic are more consistent if you're used to enterprise gear. Sophos's GUI is simpler for basic setups but can be frustrating for complex policies. Fortinet's documentation is vastly superior.
Pick the FortiGate 100F if your 100 users are mostly knowledge workers and your VPN traffic is email, web, and normal file sizes. The free client and modular licensing win. If your users are constantly transferring multi-gigabyte files over VPN or you absolutely need a single bundled SKU, get a Sophos XGS 107 and accept the higher recurring cost.
Numbers don't lie.