Sophos, a global cybersecurity leader, today announced new network security innovations designed to help organizations keep pace with the performance and security demands of the AI era. At the center is Sophos Firewall v23, alongside new XGS hardware, a standalone Sophos NDR offering, and enhancements across the broader network portfolio. Together, they drive stronger AI-era network defenses through Sophos Fusion, the AI-Native Cybersecurity Defense System, further into the network, enabling organizations to succeed by delivering the performance and connected defenses they need today and into the future.
AI is changing both how organizations use their networks and how attackers target them. Users, applications, devices, cloud services, and AI systems are generating more traffic and machine-to-machine communication, while attackers can use AI to accelerate reconnaissance, exploitation, and lateral movement. Sophos research from the 2026 State of Ransomware report also underscores the role the network can play in early threat detection: in 61% of ransomware attack events, respondents noted the firewall generated an alert before data was encrypted, sharing that early signal with other control points to turn network visibility into coordinated containment.
Sophos’ approach to securing AI-era networks rests on two pillars: performance that scales with rising demands and integrated defenses, rooted in Sophos Synchronized Security, that turn shared intelligence into coordinated protection. Sophos Fusion brings security across the broader environment, enabling control points to share information in real time and execute a coordinated response to threats.
“AI is raising the stakes for the network. Organizations need to support more encrypted traffic, applications, and automated activity while defending against attacks that can move faster and exploit gaps at greater scale,” said Daniel Cole, senior vice president of product management, Sophos. “Customers should not have to choose between enabling innovation and strengthening protection. This launch helps organizations keep pace with growing network demands while turning network visibility and intelligence into faster, coordinated defense through Sophos Fusion.”
Sophos Firewall v23 anchors the launch with enhancements that make it easier to manage, automate, and scale network security. Integration with Sophos AI Defense provides network-level visibility, reporting and policy enforcement for AI service use, including controls that help organizations sanction trusted generative AI tools and block unapproved services. A new AI Assistant helps administrators understand firewall configurations and draft rules for review, while a modern REST API supports greater automation for IT teams, partners, and MSPs.
The release also strengthens resilience and Sophos’ Secure by Design foundation. Hardware-aware high availability delivers 13X faster failover detection, reducing the detection window from four seconds to 300 milliseconds. Additional enhancements include DNS over HTTPS, DNSSEC, greater visibility into applied CVE hotfixes and security updates, and further platform hardening.
“As a CMMC Level 2 certified MSP supporting commercial organizations and highly regulated industries, including DoD contractors, we understand firsthand the importance of strong security and compliance. We leverage the same Sophos technologies within our own environment to meet our CMMC Level 2 compliance requirements that we deploy to protect our clients. The advancements in Sophos Firewall v23 and Xstream Plus, combined with the growing capabilities of Sophos Fusion, help us streamline operations, integrate with diverse technology environments, and deliver consistent, scalable security solutions. This allows us to lead by example, providing our clients with the same level of protection and security expertise we rely on ourselves.” — Paul Gibbs, VP of Managed IT, Velocity1
“As our environment has grown, having one place to manage policies across firewalls, switches and access points has become increasingly important. Managing dozens of devices individually isn’t sustainable, and centralized management gives us a much simpler way to keep policies consistent across the network.” — Aaron Carrier, Director of Infrastructure & Cyber Security, Fairstone Group
Additional innovations include:
- Four new XGS Series 1U appliances: The XGS 2380, XGS 3380, XGS 4580 and XGS 5580 deliver up to 4X higher protected throughput than earlier 1U models, with up to 59 Gbps threat protection throughput, up to 16 Gbps TLS inspection throughput, and port speeds of up to 25 Gbps on the XGS 3380 and above.
- A new standalone Sophos NDR offering that combines behavioral detection with deep packet inspection and IDS/IPS capabilities. Its Active Inline mode can drop identified malicious packets before they reach their destination, moving NDR beyond visibility to direct response. A new Sophos NDR 5500 hardware appliance will also be available.
- Xstream Plus, a new Sophos Firewall licensing option that combines Xstream Protection, Sophos Workspace Protection licenses, Enhanced Plus Support, and extended reporting retention to help customers strengthen protection, simplify management, and extend security beyond the network.
- Sophos Workspace Protection enhancements, including synchronized web policies that allow administrators to define web-filtering profiles in Sophos Fusion and apply them across Firewall, Protected Browser, and Endpoint. A new Generative AI web category provides more granular control over AI services.
Together, these innovations strengthen and extend the network’s role within Sophos Fusion. Sophos Firewall, NDR, Workspace Protection, Wireless, and Switch each provide visibility and control at different points across the environment. By sharing context through Sophos Fusion, these control points can contribute to a clearer understanding of activity and support faster, coordinated action across the full defense system.
Sophos Firewall v23, Xstream Plus, and the new XGS hardware models are now generally available. Sophos NDR will be generally available from November 10. Availability, licensing, and regional exceptions may apply.
For more information about Sophos Firewall, visit: sophos.com/firewall
For information about Sophos NDR, visit: sophos.com/ndr
