The customer support for Sophos UTM used to be better when it was still Astaro, but those days are long gone. The customer support has been good to mediocre, but not very good.
In my opinion, the best features Sophos UTM offers are part of the firewall itself, so we don't need an extra appliance, we don't need to set up extra open-source VMs or anything. It's just part of the gateway that is connected to the internet anyway, and we protect our Exchange servers with it.
I choose a rating of nine out of ten for Sophos UTM because, as I mentioned, the graphical user interface is stuck in the past, and some things here and there are not implemented to the full, such as the reverse gateway thing, reverse proxy, and web application firewall.
What I appreciate most about the features is that you can have modules with Sophos UTM, so network protection including the reverse proxy, or that you can have a module for the email protection, a module for the network protection, and so on.
At our own company, we also use Sophos UTM as a mail gateway, and we use it for the VPNs for the road warriors, providing remote access for employees.
In terms of scalability, Sophos UTM is very good. You can have large appliances or small appliances, you can change them, you can have high availability clusters, so very, very scalable in my opinion.
I can share specific outcomes regarding Sophos UTM; we've seen reduced costs certainly. Either the clients wouldn't have any security measures at all, just an ISP provided router, but those don't serve very well security-wise.
Before choosing Sophos UTM, I evaluated other options including FortiGate, OPNsense, and SonicWall.
My advice for others looking into using Sophos UTM is that it's really good to have fairly good knowledge of Linux because Sophos UTM is built on Linux and it helps debugging, it helps, for example, network tracing, and issue fixing. Other than that, get the introduction course and get ready to deploy. It's really easy. I give Sophos UTM an overall rating of nine out of ten.