Buyer beware, you're on your own
We've been using the UTM in our VPC for a few months now. A few solid pro's for the product:
1. If you're coming from the Cisco ASA world (we were), you'll find the UTM interface incredibly simple. It makes common setup a breeze.
2. It supports a lot of stuff you wouldn't expect without extra cost (e.g. OTP soft tokens, a solid LDAP integration, Site2Site VPN, etc)
3. It's linux under the hood, so you can script certain things - even use tcpdump to analyze traffic.
Unfortunately, the product & company also have some huge drawbacks.
1. Sophos doesn't really care about it's documentation. As another user noted, the documentation provided by Sophos is just terrible. A good portion of it is plain wrong or outdated, and well over half of it is simply useless. An easy example is their documentation for HA support for EC2 (spoiler, they have no HA support for EC2, they have a rough idea of how somebody might do it).
2. A lot of the advanced features are too buggy to use in production. For example, if you want to use their web application firewall (similar to the IDS feature on the ASA), you're going to be manually adjusting Apache mod_security configs or deal with regular connection losses due exceptions. Don't bother reporting these issues to Sophos, due to #3.
3. When things go wrong, Sophos support is not there to help you. This wouldn't be as big of a deal if it wasn't for the documentation problem. When dealing with Sophos support, you get the very strong indication that you're really dealing with Windows AV tech support reps. Most of the time, the tech's don't have the slightest clue about what the UTM does or why. A few days (or weeks) after you file an issue, a properly trained tech may contact you, but who has that kind of time?
4. If you undergo PCI/HIPPA complaint scans, it's probably going to be the device with the most violations. You can report the violations to Sophos support, and they'll tell you to file a UTM feature request.
5. You just can't fix certain things. One of the best parts about the UTM is it's super-easy web interface. However, it completely lacks a command line interface into a lot of it's core features (NACLs, etc). If something misbehaves (e.g. needing to remove a stuck rule), you're down to scrounging the internet for some example of how somebody got Sophos support to give out a magic command.
So, if you're ok being on your own, then the UTM is a great starting point. Lots of good open source tools and it's not terribly difficult to poke around and figure out were they've configured most things.
There are no comments to display