Sophos has announced new network security innovations led by Sophos Firewall v23, alongside new XGS hardware, a standalone Sophos NDR offering and enhancements across its broader network portfolio.

The launch extends Sophos Fusion, the company’s AI-Native Cybersecurity Defense System, further into the network. Sophos says it is designed to give organizations greater visibility and control over AI use, up to 4X higher protected throughput, and stronger network detection and response across increasingly complex environments.

Sophos Firewall v23, Xstream Plus and the new XGS hardware models are now generally available. Sophos NDR will be generally available from November 10. Availability, licensing and regional exceptions may apply.

Why the network matters more in the AI era

AI is changing both how organizations use their networks and how attackers target them. Users, applications, devices, cloud services and AI systems are generating more traffic and machine-to-machine communication, while attackers can use AI to accelerate reconnaissance, exploitation and lateral movement.

Sophos research from its 2026 State of Ransomware report points to the network’s role in early detection: in 61% of ransomware attack events, respondents noted the firewall generated an alert before data was encrypted.

Sophos says its approach rests on two pillars: performance that scales with rising demands, and integrated defenses, rooted in Sophos Synchronized Security, that turn shared intelligence into coordinated protection. Sophos Fusion enables control points to share information in real time and execute a coordinated response to threats.

“AI is raising the stakes for the network. Organizations need to support more encrypted traffic, applications, and automated activity while defending against attacks that can move faster and exploit gaps at greater scale,” said Daniel Cole, senior vice president of product management, Sophos. “Customers should not have to choose between enabling innovation and strengthening protection. This launch helps organizations keep pace with growing network demands while turning network visibility and intelligence into faster, coordinated defense through Sophos Fusion.”

SOPHOS: This ‘sector’ is most at risk from ransomware

What’s new in Sophos Firewall v23

• AI controls: Integration with Sophos AI Defense provides network-level visibility, reporting and policy enforcement for AI service use, including controls that help organizations sanction trusted generative AI tools and block unapproved services.
• AI Assistant: Helps administrators understand firewall configurations and draft rules for review.
• REST API: A modern REST API supports greater automation for IT teams, partners and MSPs.
• Faster failover: Hardware-aware high availability delivers 13X faster failover detection, reducing the detection window from four seconds to 300 milliseconds.
• Security hardening: DNS over HTTPS, DNSSEC, greater visibility into applied CVE hotfixes and security updates, and further platform hardening, building on Sophos’ Secure by Design foundation.

Additional innovations

• Four new XGS Series 1U appliances: The XGS 2380, XGS 3380, XGS 4580 and XGS 5580 deliver up to 4X higher protected throughput than earlier 1U models, with up to 59 Gbps threat protection throughput, up to 16 Gbps TLS inspection throughput, and port speeds of up to 25 Gbps on the XGS 3380 and above.
• Standalone Sophos NDR: Combines behavioral detection with deep packet inspection and IDS/IPS capabilities. Its Active Inline mode can drop identified malicious packets before they reach their destination, moving NDR beyond visibility to direct response. A new Sophos NDR 5500 hardware appliance will also be available.
• Xstream Plus: A new Sophos Firewall licensing option that combines Xstream Protection, Sophos Workspace Protection licenses, Enhanced Plus Support and extended reporting retention.
• Sophos Workspace Protection enhancements: Synchronized web policies let administrators define web-filtering profiles in Sophos Fusion and apply them across Firewall, Protected Browser and Endpoint. A new Generative AI web category provides more granular control over AI services.

Customer views

“As a CMMC Level 2 certified MSP supporting commercial organizations and highly regulated industries, including DoD contractors, we understand firsthand the importance of strong security and compliance. We leverage the same Sophos technologies within our own environment to meet our CMMC Level 2 compliance requirements that we deploy to protect our clients. The advancements in Sophos Firewall v23 and Xstream Plus, combined with the growing capabilities of Sophos Fusion, help us streamline operations, integrate with diverse technology environments, and deliver consistent, scalable security solutions. This allows us to lead by example, providing our clients with the same level of protection and security expertise we rely on ourselves.” — Paul Gibbs, VP of Managed IT, Velocity1

“As our environment has grown, having one place to manage policies across firewalls, switches and access points has become increasingly important. Managing dozens of devices individually isn’t sustainable, and centralized management gives us a much simpler way to keep policies consistent across the network.” — Aaron Carrier, Director of Infrastructure & Cyber Security, Fairstone Group

A connected defense

Sophos Firewall, NDR, Workspace Protection, Wireless and Switch each provide visibility and control at different points across the environment. By sharing context through Sophos Fusion, these control points can contribute to a clearer understanding of activity and support faster, coordinated action across the full defense system.

For more information about Sophos Firewall, visit: sophos.com/firewall

For information about Sophos NDR, visit: sophos.com/ndr