Sophos has announced version 23 of Sophos Firewall, four new 1U-format XGS firewalls, a standalone Sophos NDR offering, and a new license called Xstream Plus. The British company presents the package as a response to the pressure that generative AI usage is putting on corporate networks, both in performance and in controlling what flows through them.
The key points of Sophos’s networking news in 20 seconds
- Sophos Firewall v23 integrates AI Defense to monitor and limit generative AI use.
- The XGS 2380, 3380, 4580, and 5580 arrive, with up to 59 Gbps of declared protection.
- Sophos NDR will be sold separately starting November 10.
- The announcement discloses no pricing.
According to the press release, dated in Oxford, UK, Sophos Firewall v23, the Xstream Plus license, and the new XGS models are already generally available. Sophos NDR, the network detection and response (NDR) product, will be available starting November 10, 2026. The company warns that availability limitations, licensing conditions, and regional exceptions it doesn’t detail may apply, and it doesn’t offer pricing for any of the products either.
The company’s argument is that AI raises the bar for the network on two fronts: more encrypted traffic to inspect and more external services that employees send data to. According to Daniel Cole, senior vice president of product management at Sophos, AI is raising the stakes for the network. Cole has also said that customers shouldn’t have to choose between allowing innovation and strengthening protection.
What’s changing in Sophos Firewall v23
The development that carries the most weight in Sophos’s messaging is the firewall’s integration with Sophos AI Defense, the service the company already used to detect and control AI use inside organizations. With v23, that capability moves to the network level: the firewall offers visibility, reporting, and policy enforcement over the AI services used in the organization, with controls to approve specific generative AI tools and block unapproved ones.
The version also adds an AI-based assistant that, according to the company, helps understand existing configurations and draft rules that administrators review before applying them. The blog post in which Sophos announced v23’s early access program describes it as an assistant built into Sophos Fusion for building firewall rules, and counts more than 30 improvements in the version, grouped into five areas.
Among the less flashy but still relevant changes for IT teams and managed service providers (MSPs) are a modern REST API with token authentication designed to automate tasks, and high availability that takes hardware status into account. Sophos says failure detection is 13 times faster, dropping from four seconds to 300 milliseconds. It also adds support for DNS over HTTPS (DoH) and DNSSEC, the mechanism that authenticates DNS responses, more visibility into applied patches and vulnerability fixes (CVEs), and additional platform-hardening measures.
To back up the firewall’s role in early detection, the release cites its State of Ransomware 2026 report: in 61% of ransomware incidents, respondents said the firewall generated an alert before data was encrypted. The announcement doesn’t disclose the sample size or the survey’s methodology, so the figure reflects what the organizations surveyed by Sophos itself reported.
Four 1U XGS units and an NDR sold separately
On the hardware side, Sophos is refreshing its 1U lineup with the XGS 2380, XGS 3380, XGS 4580, and XGS 5580. The company says they deliver up to four times more protected performance than the previous 1U models, with a maximum of 59 Gbps in threat protection and 16 Gbps in encrypted TLS traffic inspection. From the 3380 up, they include ports of up to 25 Gbps. The release doesn’t break the figures down by model, so the 59 Gbps corresponds to the top of the range, not to each individual unit.
Sophos NDR stops depending on other Sophos products and becomes available on its own. It combines behavior-based detection with deep packet inspection and intrusion detection/prevention system (IDS/IPS) functions. Its Active Inline mode, according to the company, can drop malicious packets before they reach their destination, which pushes it closer to a blocking element rather than just an observation one. The announcement mentions a physical appliance, the NDR 5500, but doesn’t specify whether its availability matches the November 10 date or detail its specifications.
The release places NDR and Firewall within Sophos Fusion, the architecture under which the company groups SIEM, XDR, and MDR (managed detection and response), where both products share context. It doesn’t detail, however, integrations with third-party solutions or virtual or cloud deployment options for the new standalone offering.
| What’s new | What it is | Availability per Sophos |
|---|---|---|
| Sophos Firewall v23 | New version of the firewall system | Available |
| XGS 2380, 3380, 4580, and 5580 | 1U physical firewalls | Available |
| Xstream Plus | New license for Sophos Firewall | Available |
| Standalone Sophos NDR | Network detection and response | From 11/10/2026 |
| NDR 5500 | Physical NDR appliance | No specific date in the release |
Xstream Plus bundles licenses and brings web policy to the browser
The commercial centerpiece of the announcement is Xstream Plus, a new licensing option for Sophos Firewall that bundles Xstream Protection, Sophos Workspace Protection licenses, Enhanced Plus support, and extended report retention. Sophos presents it as a way to simplify management and extend security beyond the network perimeter, but it doesn’t publish its price or compare it with the sum of the separate licenses.
Workspace Protection, the offering with which the company champions the browser as the perimeter, also gets changes. Web policies are now defined once in Sophos Fusion and applied in sync across the firewall, Protected Browser, and the Endpoint agent. On top of that, a new generative-AI web category has been added to filter that kind of service in more detail.
There are some absences worth noting. The announcement doesn’t mention SASE (Secure Access Service Edge, the model that combines network and security delivered from the cloud) or ZTNA (zero-trust network access), a product Sophos already has in its catalog. Both concepts are usually tied to hybrid work. It also doesn’t clarify whether v23’s AI features, such as the assistant or the AI Defense integration, require additional licenses.
The release includes testimonials from two customers. Paul Gibbs, vice president of Managed IT at Velocity1, said he understands firsthand the importance of strong security and compliance. According to Aaron Carrier, director of Infrastructure and Cybersecurity at Fairstone Group, having a single place to manage policies across firewalls, switches, and access points has become increasingly important.
Frequently asked questions
What’s new in Sophos Firewall v23?
It integrates Sophos AI Defense to see and control generative AI use on the network, adds an AI assistant to review configurations and draft rules, a modern REST API, high availability with failure detection in 300 milliseconds, and support for DNS over HTTPS and DNSSEC.
When will Sophos NDR be available as a standalone product?
Sophos says it will be generally available starting November 10, 2026, with possible regional and licensing limitations. The release doesn’t specify a date for the NDR 5500 appliance.
How much performance do the new Sophos 1U XGS units offer?
According to the company, up to 59 Gbps of threat protection and up to 16 Gbps of TLS inspection, with ports of up to 25 Gbps from the 3380 model onward. These are maximum figures for the range, not for each individual model.
How much does the Xstream Plus license cost?
Sophos hasn’t published pricing in the announcement. It only details that the license includes Xstream Protection, Workspace Protection, Enhanced Plus support, and more report retention.
Sources:
- Sophos: Sophos Helps Organizations Secure the AI-Era Network
- Sophos: Sophos Firewall v23 Early Access
- Sophos Firewall (product page)
- Sophos: State of Ransomware
This article is also available in Spanish: «Sophos lanza Firewall v23 y un NDR independiente para controlar la IA en la red», on revistacloud.com.
