When Windows is done with a program it clears out the memory that program used and marks it as available to use, which means that High Memory Utilization is very easy to alert on. Memory is either used or it isn’t.
Sophos however is a Linux based appliance and it has a more complicated way of handling memory. When it’s finished with a program or process, it marks the memory as available for use, but does not clear it—the logic behind this is the exact same data MAY be needed again in the future. If so, the device can by-pass the whole reloading process for that same data and just use the previous data that was there.
This is highly efficient because it’s using ALL available memory as a cache which makes it both used but available. However, it can lead to High Memory Utilization alerts occurring when polling for free memory, as it's a matter of interpretation whether the cached memory is included or not.