Sophos AI Defense is now generally available, giving organizations visibility into the AI tools used by employees and applications, including unauthorized tools, while enforcing security policies across their environments.

Developed by Sophos, the solution is delivered through Sophos Fusion, the company’s AI-native cybersecurity defense system. It connects security controls across devices, networks, sign-ins, and browsers, helping organizations manage AI adoption without adding another disconnected security tool.

The launch comes as organizations face growing risks from unsanctioned AI use and the potential exposure of sensitive business data.

Sophos X-Ops has tracked several AI-related developments this year, including an attacker using AI agents inside a customer’s network to build and test nearly 80 malware modules. Researchers have also identified threat actors selling brokered API keys for advanced AI models, underground forums trading jailbreak techniques, and criminal recruiters seeking AI prompt engineers.

Research cited by Sophos highlights the scale of the challenge. Sixty-nine percent of organizations suspect or have evidence that employees are using unsanctioned AI agents and tools. Meanwhile, 82% have discovered shadow AI agents in their environments over the past year, and 90% of IT leaders are concerned about the associated risks. IDC projects that the number of AI agents will reach 1.3 billion by 2028.

Each unauthorized AI tool or agent can introduce another attack surface and create opportunities for sensitive data to leave an organization. To address these risks, Sophos AI Defense combines signals from devices, networks, identity systems, and browsers to map AI activity across an environment.

The solution evaluates who or what is acting, how the activity is taking place, and which data is involved. This helps security teams distinguish routine AI usage from activity that requires intervention.

Real-time security guardrails inspect prompts, uploads, and other AI interactions as they occur. The system also feeds activity into Sophos Fusion, enabling teams using Sophos XDR and Sophos Managed Detection and Response (MDR) analysts to investigate and respond through their existing workflows.

“Organizations are adopting AI faster than they can secure it, and most security teams can’t answer three basic questions: which AI tools are running, what data is going into them, and whether that activity lines up with policy,” said Kyle Falkenhagen, senior vice president of product management at Sophos.

He added that Sophos AI Defense provides security teams with the visibility and controls needed to make informed decisions about AI usage.

The solution also targets organizations with limited security resources. Since it operates through Sophos Fusion, security teams can activate AI security capabilities from day one. Managed service providers (MSPs) can also offer these capabilities across their customer base.

Anthony Bender, CTO at Empyreal Logistics, said the company previously lacked a way to block and regulate unauthorized AI tools when customers asked about its AI usage and security practices.

“We now have a handle on how we want our employees to use AI, and we can show our customers we are doing what we are saying,” Bender said. He added that the company can now provide a clear response when customers ask how it manages AI security.

The announcement coincides with Cybersecurity Awareness Month, as organizations increasingly focus on securing AI adoption.

Sophos AI Defense is available now. Additional findings on AI-related security threats are available in the Sophos AI Security 2026 report. Organizations can also find product information on the Sophos AI Defense product page.

Related post

View all