Sophos has announced the launch of Sophos Fusion, a new AI-based cybersecurity platform designed to provide unified protection against an increasingly complex threat landscape. The company presents this solution as a system capable of coordinating detection and incident response from a single environment, adapting to the rapid evolution of AI-driven cyberattacks.
Sophos’s proposal responds to a new defense model where all security components — from various control points to services, data sources, and analysis teams — operate in an integrated manner. This architecture also allows for the incorporation of both proprietary and third-party solutions, fostering continuous information exchange that enhances detection capabilities, accelerates threat response, and helps optimize security management.
The company emphasizes that the advent of artificial intelligence has transformed the way cybercriminals operate. Modern attacks can move throughout an organization’s entire tech infrastructure as a single coordinated operation, dramatically reducing the time between initial intrusion and attack realization. While this process could take several days a few years ago, it can now be completed in just a few hours.
In light of this reality, Sophos warns that many companies still manage their protection using a high number of independent tools, which hampers effective response. According to the company, an average organization uses more than 45 different security solutions—a situation that increases costs, requires managing multiple management consoles, and adds significant operational burdens for IT and cybersecurity teams. In response, Sophos Fusion aims to centralize management and automate processes to provide a faster, more coordinated response to current threats.
A cybersecurity defense system addresses this market challenge by being defined by four key characteristics:
- Shared ‘context lake’, where signals from all control points flow into a single real-time data layer.
- Synchronized Security™, where detection at one control point triggers a coordinated action across all others simultaneously.
- Agent autonomy with human oversight, where systems investigate and respond within boundaries that are continually calibrated by analysts.
- Cumulative intelligence, where each detected threat reinforces the defense for all clients.
Sophos Fusion is the evolution of Sophos Central, the system trusted daily by 625,000 organizations worldwide. It has now been redesigned on an open architecture that incorporates analytics from Secureworks Taegis following the acquisition of that company in 2025.
This system leverages agent-based AI to connect and synchronize all control points across the environment. Sophos demonstrates its effectiveness and scalability in its own operations, managing the world’s largest agent-based SOC with over 40,000 customers: 52% of cases are fully resolved through AI, and the average time from alert to fully automated response is just 89 seconds. Additionally, Sophos Endpoint is designed to stop entire categories of behavior-based attacks, such as memory misuse, encryption, data exfiltration, and other techniques used by both human and AI attackers.
“As AI increases the speed, scale, and complexity of attacks, organizations need a modern, connected, intelligent, and adaptive defense,” states Joe Levy, CEO of Sophos. “Sophos Fusion is designed as a defense system optimized for workflows where people and AI collaborate. We deliver the most comprehensive solution in a new category—an timely breakthrough for the AI era.”
Sophos Fusion offers protection across endpoints, detection and response (EDR), extended detection and response (XDR), next-generation SIEM, identity threat detection and response (ITDR), managed detection and response (MDR), network security, email, cloud, and advisory services—all integrated into a single defense system.
It is an open and native system: Sophos develops its core control points natively, and over 500 third-party integrations feed the same shared data layer, ensuring that endpoint tools, firewalls, or identity solutions already in use by an organization function as part of the integrated system alongside Sophos’s defense and protection.
Expanding the Sophos Fusion Defense System
Sophos is expanding Fusion with the following capabilities, which will be generally available between August and October 2026:
- Sophos Next-Gen SIEM provides long-term data retention, compliance reporting, and analytics on unified data, with pricing based on the number of users and servers instead of data volume, allowing organizations to include all telemetry without unpredictable billing or data gaps. General availability begins August 15, 2026.
- Sophos AI Defense protects the AI tools organizations are adopting, giving visibility into the AI in use—including shadow AI—enforcing policies, and safeguarding data these tools can access, all built on capabilities already integrated into the system. Early access available in August 2026; general release in October 2026.
- Sophos CISO Advantage provides organizations access to CISO-level guidance, with continuous control validation, compliance mapping, industry benchmarking, and risk assessment, regardless of whether they have a CISO. It combines integrated technology, agent-based AI, and active threat intelligence in Sophos Fusion with trusted human expertise via Sophos’s global MSP network. For organizations with a CISO, it offers a more efficient and integrated way to manage risk, validate controls, and report to leadership. For those without, it offers practical security leadership based on their real environment. Available from October 2026.
- Sophos MDR is expanding with continuous AI-powered threat hunting—driven by the Sophos X-Ops research team—and broader bidirectional response covering endpoints, firewalls, cloud, email, and identity to neutralize threats before they impact the business, without clients needing to build a SOC. General availability starts August 15, 2026.
- Sophos XDR with Secureworks technology has been redesigned based on Secureworks Taegis analytics, incorporating thousands of detectors, a new analyst experience in Sophos Fusion, and integrated SOAR automation with response scripts, enabling faster, more precise detection and response with less manual effort. General availability begins August 15, 2026.
Sophos operates within one of the world’s largest ecosystems of MSPs, MSSPs, resellers, distributors, and technology partners. Sophos Fusion provides partners with a single system to sell and manage—rather than multiple standalone products—creating new avenues for recurring revenue through Sophos CISO Advantage (designed specifically for MSP models), transforming partners into strategic security advisors. As intelligence accumulates across protected environments, each managed client benefits from all threat detections across other deployments, enhancing the results delivered by partners.
