Sophos has announced the general availability of Sophos AI Defense, a cybersecurity solution designed to detect which artificial intelligence (AI) tools employees and an organization’s applications are using, including those that haven’t been authorized by the IT department. The platform can identify that activity and apply real-time security policies to reduce the risk of sensitive data being exposed or AI services being used outside internal rules.
Sophos AI Defense in 20 seconds
- Sophos AI Defense is now available to help companies control the use of AI tools and agents.
- The solution aims to detect unauthorized applications, also known as shadow AI.
- It combines signals from the device, the network, identity systems and the browser to identify AI-related activity.
- Its controls can inspect prompts, uploaded files and other interactions to help prevent information leaks.
- The activity feeds into Sophos Fusion and into Sophos XDR and Sophos MDR workflows.
The expansion of generative artificial intelligence and of agents capable of carrying out tasks is creating a new challenge for security teams. Employees can turn to external tools to draft documents, analyze information or automate processes without the company having a full picture of which services they’re using or what data they’re sharing with them.
This phenomenon is known as shadow AI. The problem isn’t limited to the use of applications the organization hasn’t approved. It also includes agents and services connected to corporate systems that can access sensitive information or carry out operations without proper controls.
Sophos presents its new solution as a way to provide visibility into that activity and set boundaries without forcing companies to manage a separate security tool for every environment.
Visibility into AI tools and the data they use
Sophos AI Defense pulls together signals from different points across the technology infrastructure to identify AI-related activity. The company cites four main areas: devices, the network, identity systems and the browser.
The platform analyzes who is carrying out an action, how they’re behaving and what information is involved. With that data, it aims to distinguish normal application use from activity that could breach internal policies or pose a risk to the organization.
The goal is to answer three questions that, according to Sophos, remain difficult for many companies to resolve: which AI tools are running, what data is being fed into them, and whether that use complies with established rules.
The solution includes real-time controls to inspect prompts written for models, files that get uploaded, and other interactions with AI tools. These mechanisms are designed to help prevent confidential information from leaving corporate systems without authorization.
The company doesn’t detail every supported application, the specific detection criteria or the technical limits of the controls in its announcement. Interested organizations will therefore need to review the product documentation to see how it fits their applications, browsers, identity systems and data protection policies.
Integration with Sophos Fusion, XDR and MDR
One of the standout features is integration with Sophos Fusion, the company’s cybersecurity defense system. Activity detected by AI Defense can be fed into Sophos XDR and Sophos MDR workflows.
XDR, short for Extended Detection and Response, refers to solutions that correlate information from different sources to detect and investigate threats. MDR, or Managed Detection and Response, refers to managed services in which specialists oversee security and help investigate and respond to incidents.
This integration aims to keep security teams from having to switch between disconnected tools to understand what’s happening. Information about AI use can be folded into the investigation and response processes that security teams and managed service providers already rely on.
The offering is also aimed at companies with limited security resources and at managed service providers (MSPs), who can offer these capabilities to their clients. Sophos argues that integration with Fusion makes it easier to turn on AI security controls without adding yet another standalone platform to manage.
Either way, how effective the protection is will depend on the configuration, which applications can be monitored and the policies each organization sets. Detecting an unauthorized tool is only the first step: organizations also have to decide which uses are allowed, what information can be shared, and which actions should be blocked or reviewed.
Sophos warns of growing AI-related risks
The company pairs the launch with data on the unauthorized use of AI tools and agents. According to the references cited in its announcement, 69% of the cybersecurity leaders surveyed suspect their employees are using unauthorized AI agents and tools, or have evidence that they are.
Another survey, commissioned by Token Security from the Cloud Security Alliance, found that 82% of participating organizations had discovered shadow AI agents over the past year. Separately, a Komprise study published in June 2025 found that 90% of the IT leaders surveyed were concerned about the risks of this kind of activity.
These figures come from different studies, with different samples and methodologies, so they shouldn’t be read as a single market measurement or as directly comparable percentages. They do reflect growing concern among technology leaders about the lack of visibility and control over corporate AI use.
Sophos also cites research from its Sophos X-Ops team on criminal activity tied to these technologies. The cases identified include an attacker who used AI agents inside a client’s network to build and test close to 80 malware modules, the sale of API keys for advanced models, and the sharing of techniques to bypass AI systems’ restrictions.
The company also points to an IDC forecast published in May 2025 projecting 1.3 billion AI agents by 2028. That’s an estimate, not a confirmed current figure.
The launch of Sophos AI Defense aims to respond to that landscape by combining visibility, usage policies and real-time controls. The solution is already available, although how useful it is for each company will depend on the specific capabilities it needs to protect and how it folds the tool into its security strategy.
Frequently asked questions
What is Sophos AI Defense?
It’s a cybersecurity solution that identifies the use of AI tools and agents within an organization and applies controls to reduce the associated risks.
What does shadow AI mean?
It refers to the use of AI applications, services or agents without proper approval or oversight from the organization. It can create risks when confidential data is shared or permissions are granted without controls.
How does Sophos AI Defense integrate with other solutions?
The tool works through Sophos Fusion and can feed detected activity into Sophos XDR and Sophos MDR workflows to support investigation and response.
Is Sophos AI Defense available now?
Yes. Sophos has announced its general availability. Companies should check the official documentation for requirements, supported features and commercial terms.
