Sophos has introduced new network security technologies designed to strengthen enterprise defenses against increasingly sophisticated cyber threats in the artificial intelligence (AI) era. The launch includes Sophos Firewall v23, new XGS hardware appliances, a standalone Network Detection and Response (NDR) solution, and enhancements across its network security portfolio.
The upgrades extend Sophos Fusion, the company’s AI-Native Cybersecurity Defense System, to provide coordinated threat detection and response across networks, endpoints, and other security control points.
Sophos said the growing use of AI, cloud services, connected devices, and automated applications is increasing network traffic and creating new opportunities for cyberattacks. According to its 2026 State of Ransomware report, firewalls generated alerts before data encryption in 61% of reported ransomware attack events, highlighting their role in early threat detection.
At the center of the announcement is Sophos Firewall v23, which introduces integration with Sophos AI Defense for network-level visibility, reporting, and policy enforcement covering AI service usage. Administrators can allow trusted generative AI services while blocking unapproved platforms.
The release also introduces an AI Assistant that helps administrators understand firewall configurations and draft security rules for review. A modern REST API provides additional automation capabilities for IT teams, partners, and managed service providers.
To improve network resilience, hardware-aware high availability delivers 13 times faster failover detection, reducing the detection window from four seconds to 300 milliseconds. Other enhancements include DNS over HTTPS, DNSSEC, improved visibility into security updates and CVE hotfixes, and additional platform hardening.
Sophos is also introducing four new XGS Series 1U appliances: the XGS 2380, XGS 3380, XGS 4580, and XGS 5580. These models deliver up to four times higher protected throughput than previous 1U models, with threat protection throughput reaching 59 Gbps and TLS inspection throughput of up to 16 Gbps.
Another major addition is the standalone Sophos NDR, which combines behavioral detection, deep packet inspection, and IDS/IPS capabilities. Its Active Inline mode can block identified malicious packets before they reach their destination. A dedicated Sophos NDR 5500 hardware appliance will also be available.
The company also introduced Xstream Plus, a licensing option combining network protection, Sophos Workspace Protection licenses, Enhanced Plus Support, and extended reporting retention.
Meanwhile, Sophos Workspace Protection enhancements include synchronized web policies that allow administrators to apply consistent web-filtering rules across firewalls, protected browsers, and endpoints. A new Generative AI web category provides more granular control over AI services.
Sophos Firewall v23, Xstream Plus, and the new XGS hardware models are now generally available. Sophos NDR is scheduled for general availability beginning November 10, 2026.
