Unlike free clients that dump logs into random temp folders, the SophosConnect MSI uses: %ProgramData%\Sophos\Connect\Logs\sophos_connect_250g.log
Use IPsec for internal file servers and RDP. Use SSL for coffee shop Wi-Fi and strict corporate proxies.