Sophos Fusion targets AI-speed attacks

Sophos has launched what the cybersecurity company calls “the industry’s most complete AI-native cybersecurity defence system”. The platform, Sophos Fusion, is designed to deliver a co-ordinated response to AI-era threats.

According to Sophos, a cybersecurity defence system is an emerging category in the industry: a single, open architecture where every control point, every service, every data source, and every analyst operates as one, whether the control point is native or third-party. New sources can enhance the system and accelerate outcomes while reducing overhead.

“The AI era has changed what modern defence requires,” says Sophos. “Attacks can now move across an organisation’s environment as a single coordinated operation, further compressing the time from first access to impact from days to hours. Most security and IT leaders are trying to meet that speed with a growing pile of disconnected tools. The typical enterprise runs more than 45 separate security products, which leaves teams with more spending, more dashboards, and more manual work while attackers move at machine speed.”

The company says a cybersecurity defence system can address this market failure through the following four characteristics:

• One shared context lake, where every signal from every control point flows into a single data layer in real time.
• Synchronised Security, where a detection on one control point triggers coordinated action across the others at the same moment.
• Agentic autonomy with human governance, where the system investigates and responds inside boundaries analysts set and continuously calibrate.
• Compounding intelligence, where every threat seen across the defended base makes every customer’s defence stronger.

Sophos Fusion builds on Sophos Central and uses an open architecture that incorporates Secureworks Taegis analytics following Sophos’s 2025 acquisition of Secureworks. The platform uses agentic AI to connect and synchronise security controls across an organisation’s environment. The system supports more than 40,000 customers through the company’s security operations centre.

According to Sophos, AI resolves 52% of cases without human intervention. The average time from an alert to an automated response is 89 seconds. Sophos Endpoint detects and blocks attack methods based on behaviour. These include memory abuse, data encryption, data exfiltration and techniques used by human or AI-based attackers.

Joe Levy, Sophos CEO, says: “As AI increases the speed, scale, and complexity of attacks, organisations need a modern connected, intelligent, and adaptive defence. Sophos Fusion is built as a defence system optimised for Human-AI workflows. We bring the most complete solution to a new category, a timely advancement demanded by the AI era.”

Sophos Fusion offers endpoint protection, endpoint detection and response (EDR), extended detection and response (XDR), next-gen SIEM, identity threat detection and response (ITDR), managed detection and response (MDR), network security, email, cloud, and advisory services as one defence system. The platform is open as well as native: Sophos builds the core control points natively, and more than 500 third-party integrations feed the same shared data layer, so an organisation’s existing endpoint, firewall, or identity tools operate as part of the system alongside Sophos defence and protection.

Fernando Montenegro, The Futurum Group VP and practice lead for cybersecurity and resilience, says: “Futurum Group’s market forecast projects Security Operations – the segment where AI-native orchestration and adaptive defence systems compete – will double from $18-billion to $37-billion by 2029, growing faster than any other cybersecurity category. This is where the next generation of cyber defence will be won.”

Neil MacDonald, Gartner analyst, says: “Simply adding more tools onto the stack won’t provide the intelligent cyber defence fabric that organisations need to mitigate AI-orchestrated attacks like the one Anthropic recently identified. Organisations need an intelligent overlay that connects the different elements of their cybersecurity toolset to proactively and reactively respond to risks and threats at machine speeds.” 

Expanding the Sophos Fusion defence system

Sophos says the following expanded Fusion capabilities will become generally available between August and October 2026:

• Sophos Next-Gen SIEM provides long-term data retention, compliance reporting, and analytics on the same unified data, priced by users and servers rather than by data volume, so organisations can feed in all of their telemetry without unpredictable billing or the gaps that come from holding data back. Generally available 15 August 2026.
• Sophos AI Defence secures the AI that organisations are adopting, giving them visibility into AI tools in use including shadow AI, control to enforce policy, and protection for the data those tools can reach, built on capabilities already inside the system. Early access in August 2026, generally available October 2026.
• Sophos CISO Advantage gives every organisation access to CISO-level guidance, with continuous control validation, compliance mapping, peer benchmarking, and risk assessment, whether they have a CISO or not. It combines integrated technology, agentic AI, and active threat intelligence in Sophos Fusion with trusted human expertise delivered through Sophos’ extensive global network of managed service providers (MSPs). For organisations with a CISO, it delivers a more efficient, integrated way to manage risk, validate controls, and communicate progress to the board. For those without one, it provides practical security leadership grounded in their real environment. Availability beginning October 2026.
• Sophos MDR is expanding with continuous, AI-enabled threat hunting fed by the Sophos X-Ops research team and broader two-way response across endpoint, firewall, cloud, email, and identity, so threats are neutralised before they disrupt business and without the customer building a SOC. Generally available August 15, 2026.
• Sophos XDR, powered by Secureworks, is rebuilt on Secureworks Taegis analytics, adding thousands of detectors, a new analyst experience in Sophos Fusion, and built-in SOAR automation with playbooks, giving teams faster, higher-fidelity detection and response with less manual work. Generally available 15 August 2026.

Sophos distributes products and services through a global network of MSPs, managed security service providers, resellers, distributors and technology partners. Sophos Fusion provides partners with a single platform for selling and managing security services rather than multiple point products. The company says this approach supports recurring revenue opportunities.

Sophos CISO Advantage has been designed for the MSP model and aims to support partners providing strategic security guidance. According to Sophos, shared threat intelligence across customer environments can improve threat detection and security outcomes for organisations managed by partners.

* Visit the Sophos website here.