Really feel there should be 2FA on the Central login.
The supported 2FA services are Sophos Authentication and Google Auth apps.
Luke Bell commented
There is 2FA available using the Sophos Authenticator app: Global Settings, Multi-Factor Authentication (MFA)
The ability to use an external authenticator token like Google Authenticator or FortiToken Mobile would be great