Sophos has announced Sophos Firewall v23, new XGS hardware, a standalone Sophos NDR offering and enhancements across its network portfolio. The launch is designed to help organizations meet the performance and security demands of the AI era.

The updates extend Sophos Fusion, the AI-Native Cybersecurity Defense System, further into the network.

AI Is Changing Network Demands

Users, applications, devices, cloud services and AI systems are generating more traffic and machine-to-machine communication. At the same time, attackers can use AI to speed up reconnaissance, exploitation and lateral movement.

The network also plays a role in early detection. The Sophos 2026 State of Ransomware report found that in 61% of ransomware attack events, respondents noted the firewall generated an alert before data was encrypted. That early signal can be shared with other control points to support coordinated containment.

Sophos says its approach rests on two pillars. The first is performance that scales with rising demands. The second is integrated defenses, rooted in Sophos Synchronized Security, that turn shared intelligence into coordinated protection.

Sophos Fusion brings security across the broader environment. It lets control points share information in real time and respond to threats together.

“AI is raising the stakes for the network,” said Daniel Cole, senior vice president of product management at Sophos. “Organizations need to support more encrypted traffic, applications, and automated activity while defending against attacks that can move faster and exploit gaps at greater scale.”

He added, “Customers should not have to choose between enabling innovation and strengthening protection. This launch helps organizations keep pace with growing network demands while turning network visibility and intelligence into faster, coordinated defense through Sophos Fusion.”

Sophos Firewall v23 Adds AI Visibility and Automation

Sophos Firewall v23 anchors the launch. It includes enhancements that make network security easier to manage, automate and scale.

Integration with Sophos AI Defense provides network-level visibility, reporting and policy enforcement for AI service use. Organizations can sanction trusted generative AI tools and block unapproved services.

A new AI Assistant helps administrators understand firewall configurations and draft rules for review. A modern REST API also supports greater automation for IT teams, partners and MSPs.

Stronger Resilience and Secure by Design Updates

The release also strengthens resilience and the Secure by Design foundation of Sophos. Hardware-aware high availability delivers 13X faster failover detection. The detection window drops from four seconds to 300 milliseconds.

Other enhancements include:

• DNS over HTTPS
• DNSSEC
• Greater visibility into applied CVE hotfixes and security updates
• Further platform hardening

Customer Perspectives

Velocity1 is a CMMC Level 2 certified MSP that supports commercial organizations and highly regulated industries, including DoD contractors. Paul Gibbs, VP of Managed IT at Velocity1, said the company uses the same Sophos technologies internally that it deploys for clients.

“We leverage the same Sophos technologies within our own environment to meet our CMMC Level 2 compliance requirements that we deploy to protect our clients,” Gibbs said. “The advancements in Sophos Firewall v23 and Xstream Plus, combined with the growing capabilities of Sophos Fusion, help us streamline operations, integrate with diverse technology environments, and deliver consistent, scalable security solutions.”

He added, “This allows us to lead by example, providing our clients with the same level of protection and security expertise we rely on ourselves.”

Aaron Carrier, Director of Infrastructure & Cyber Security at Fairstone Group, pointed to the value of central management.

“As our environment has grown, having one place to manage policies across firewalls, switches and access points has become increasingly important,” Carrier said. “Managing dozens of devices individually isn’t sustainable, and centralized management gives us a much simpler way to keep policies consistent across the network.”

New Hardware, NDR and Licensing

Sophos also announced several additional innovations.

Four new XGS Series 1U appliances. The XGS 2380, XGS 3380, XGS 4580 and XGS 5580 deliver up to 4X higher protected throughput than earlier 1U models. They offer up to 59 Gbps of threat protection throughput and up to 16 Gbps of TLS inspection throughput. Port speeds reach up to 25 Gbps on the XGS 3380 and above.

A standalone Sophos NDR offering. It combines behavioral detection with deep packet inspection and IDS/IPS capabilities. Its Active Inline mode can drop identified malicious packets before they reach their destination. This moves NDR beyond visibility to direct response. A new Sophos NDR 5500 hardware appliance will also be available.

Xstream Plus. This new Sophos Firewall licensing option combines Xstream Protection, Sophos Workspace Protection licenses, Enhanced Plus Support and extended reporting retention. It is meant to help customers strengthen protection, simplify management and extend security beyond the network.

Sophos Workspace Protection enhancements. Synchronized web policies let administrators define web-filtering profiles in Sophos Fusion. Those profiles apply across Firewall, Protected Browser and Endpoint. A new Generative AI web category gives more granular control over AI services.

A Connected View Across the Environment

Sophos Firewall, NDR, Workspace Protection, Wireless and Switch each provide visibility and control at different points in the environment. Through Sophos Fusion, they share context. This supports a clearer understanding of activity and faster, coordinated action across the full defense system.

Availability

Sophos Firewall v23, Xstream Plus and the new XGS hardware models are now generally available. Sophos NDR will be generally available from November 10. Availability, licensing and regional exceptions may apply.

For more information about Sophos Firewall, visit sophos.com/firewall. For information about Sophos NDR, visit sophos.com/ndr.

In short, Sophos Firewall v23 and the wider network updates aim to combine higher performance with shared intelligence across control points.

Related post

View all