Sophos exclusions are targeted exceptions to specific protection features—not a universal switch for Sophos security. Choose an exclusion that matches the problem, limit it to the affected users or devices, and check which platform and scan modes it changes. Sophos’s official safe-use guidance warns: “Exclusions may significantly reduce your protection.”
What a Sophos exclusion changes
Sophos Central offers different exclusion types for different protection features. A file or folder scanning exclusion is not the same as an exploit mitigation, ransomware, website, or hashing exclusion. The effect depends on the selected type, operating system, product configuration, and—where applicable—scan mode. Before adding one, identify the detection or behavior causing the problem and the feature involved.
As an Amazon Associate I earn from qualifying purchases.
Sophos lists global exclusion types including file/folder exclusions for Windows and Mac/Linux, AMSI Protection for Windows, Malicious Network Traffic Prevention (IPS) for Windows, hashing for Windows, and driver detection for Windows. Other feature-specific exclusions are managed separately. Availability and labels can vary by platform, product, role, and tenant configuration. Sophos Central: Global Exclusions
Choose an exclusion that matches the symptom
A file or application is incorrectly detected
For a false positive, Sophos recommends using the SHA from the detection event when available, rather than excluding the file by path. A path exception could also allow a malicious replacement or a modified file placed at that same location. Follow Sophos’s false-positive guidance for the detection and exclusion type available in your environment. Sophos: Using exclusions safely
#1 Best Overall
- XGS 88 (Hardware Only) - Next-generation firewall appliance only; add a Sophos subscription to enable IPS, web security, VPN, and advanced threat defense.
- Equipped with 4 x 2.5 GE copper ports, supporting up to 9.9 Gbps firewall performance for small offices and branch deployments.
- Purpose built next generation firewall hardware engineered for high performance, visibility, and reliable operation in business networks.
- SD-WAN optimization provides resilient connectivity and intelligent traffic routing across multiple WAN connections.
- VPN ready architecture supports secure site to site networking and encrypted remote employee access.
An application slows down while accessing a folder
If performance trouble occurs when an application accesses a particular folder, Sophos recommends excluding the application’s full path as a process exclusion rather than excluding the folder. This is narrower: files written by that process are not scanned through that route, while files in the folder may still be detected if malware arrives another way. Other protections, such as runtime protection, may remain available depending on the chosen exclusion and configuration; do not treat that as a guarantee. Sophos: Using exclusions safely
An exploit or ransomware feature is involved
Exploit mitigation and ransomware protection have their own exclusion types and effects; they are not ordinary file-scanning exceptions. Sophos documents path-based exploit mitigation or activity monitoring exclusions separately from ransomware protection exclusions. Do not disable these controls as a general performance fix. If a feature-specific exception is necessary, keep it as narrow as possible and preserve selected mitigations where the product allows it. Sophos: Exploit mitigation exclusions · Sophos: Ransomware protection exclusions
Rank #2
- XGS 118 (Hardware Only) - Next-generation firewall appliance only; add a Sophos subscription to enable IPS, web security, VPN, and advanced threat defense.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, delivering up to 15.5 Gbps firewall performance for mid sized organizations.
- Purpose built next generation firewall hardware engineered for high performance, visibility, and reliable operation in business networks.
- SD-WAN optimization provides resilient connectivity and intelligent traffic routing across multiple WAN connections.
- VPN ready architecture supports secure site to site networking and encrypted remote employee access.
A website or file-hashing workflow is involved
A website exclusion also means Sophos does not check that site’s category for web control. A hashing exclusion has a different consequence: Sophos says it stops Event Journals and the Data Lake from generating file hashes, and advises using this exclusion type only if Sophos asks. Neither is a routine substitute for a file-scanning exclusion. Sophos Central: Global Exclusions
Scope the exception to the affected devices
A global exclusion applies across users, computers, and servers. If only particular devices or people need the exception, Sophos directs administrators toward policy exclusions so the change is limited to the relevant scope. Use the narrowest available scope and avoid broadening an endpoint-specific problem into a tenant-wide exception. Sophos Central: Global Exclusions
Rank #3
- Network administrators' main fears are that SSL inspection will have a performance impact or cause something to break, impacting the user experience. Sophos Firewall removes the blind spots caused by encrypted traffic by allowing you to use SSL inspection while maintaining performance efficiency.
- TLS 1.3 Decryption: Remove an enormous blind spot with intelligent TLS inspection that’s fast and effective, supporting the latest standards with extensive exceptions and point-and-click policy tools to make your job easy.
- Deep Packet Inspection: Stop the latest ransomware and breaches with high-performance streaming deep packet inspection, including next-gen IPS, web protection, and app control, as well as deep learning and sandboxing powered by SophosLabs Intelix.
- Sophos Firewall and the XGS Series appliances with dedicated Xstream Flow Processors enable the ultimate in application acceleration, high-performance TLS inspection, and powerful threat protection
- Specifications: Firewall throughput: 35,000 Mbps| Firewall IMIX: 20,000 Mbps | Firewall Latency (64 byte UDP): 4 µs | IPS throughput: 7,000 Mbps | Threat Protection throughput: 1,400 Mbps
Add a global exclusion in Sophos Central
For the current Sophos Central customer help flow, global exclusions are under Global Settings > Protection and Remediation > Allow and Block > Global Exclusions. The exact controls may differ for another product, platform, role, or tenant arrangement.
- Open Global Settings > Protection and Remediation > Allow and Block > Global Exclusions.
- Select the exclusion type that matches the protection feature and object involved.
- Enter the relevant value. For a Windows file or folder exclusion, use the actual full path approved for your application and environment.
- For a Windows file or folder exclusion, choose whether it applies to real-time scanning, scheduled scanning, or both.
- Save the change, then verify that the exception is limited to the intended scope and protection feature.
If the exception should affect only a subset of users or devices, use the applicable policy exclusion rather than the global list. Sophos Central labels and available choices can vary. Sophos Central: Global Exclusions
Rank #4
- XGS 118 with 3 Years Standard Protection - Next-generation firewall appliance with Standard Protection subscription providing firewall, VPN, intrusion prevention, web security, and application control, managed through Sophos Central for unified policies and reporting.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, delivering up to 15.5 Gbps firewall performance for mid sized organizations.
- Protects users from ransomware, malware, phishing, and intrusion attempts before they reach endpoints or applications.
- SD-WAN features deliver reliable, optimized application performance and intelligent multi link failover.
- Includes Standard Protection – Comprehensive security package with firewall, intrusion prevention, VPN, web security, and application control to defend against everyday threats and keep business operations safe.
Keep Windows scanning exclusions precise
Sophos supports full paths and certain wildcards for Windows scanning exclusions, but broad patterns can exempt far more than the application at issue. The global exclusions page does not accept *.*. Avoid whole-drive exclusions and broad patterns such as *.exe; use an exact path that corresponds to the software vendor’s approved location. Sophos Central: Global Exclusions
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Sophos specifically warns against excluding these locations:
Best Value
- XGS 128 (Hardware Only) - Next-generation firewall appliance only; add a Sophos subscription to enable IPS, web security, VPN, and advanced threat defense.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, providing up to 19.1 Gbps firewall throughput for larger offices.
- Purpose built next generation firewall hardware engineered for high performance, visibility, and reliable operation in business networks.
- SD-WAN optimization provides resilient connectivity and intelligent traffic routing across multiple WAN connections.
- VPN ready architecture supports secure site to site networking and encrypted remote employee access.
C:WindowsC:ProgramDataC:Users<Username>- The Startup folder
Network-share behavior can depend on whether an exclusion is drive-specific, so check Sophos’s Windows guidance before applying one to shared storage. Sophos: Windows exclusions
Check the platform and management setup
macOS
Sophos documents exclusions using POSIX paths and covers scanning or ransomware exclusion scenarios. Prefer policy scope for a device-specific need, and confirm the current product’s behavior before applying an exception. Sophos: macOS exclusions
Linux servers
The surfaced Linux guidance is for Linux servers: use policy scope where appropriate and specify full paths. Do not assume that every Windows exclusion type or control is available on Linux. Sophos: Linux server exclusions
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallEnterprise, partner-managed, or restricted tenants
In enterprise or partner-managed environments, templates and delegated permissions can affect where exclusions are configured and who can edit them. Sophos notes that some exclusions created from events are not included in the Global Exclusions list managed in the template view. If an option is locked, missing, or appears in a different place, check the management hierarchy and your role’s permissions. Sophos Enterprise: Global Exclusions
Review and remove exceptions that are no longer needed
Keep a record of why each exception exists, its owner, scope, feature, and any expiry or review date used by your team. Revisit exceptions periodically and remove those no longer required. This is especially important for global or broadly matched exceptions, because they can continue to apply after the original application or troubleshooting need has changed. Sophos: Using exclusions safely
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
