Terry KS MALAYSIA, 11 NOVEMBER 2026 – Global cybersecurity specialist Sophos has announced an expanded array of network defense solutions designed to help organizations keep pace with escalating throughput and threat mitigation demands in artificial intelligence environments. The release centers on Sophos Firewall v23, supported by four high-performance XGS Series 1U hardware models, a standalone Network Detection and Response offering, and portfolio-wide enhancements integrated through Sophos Fusion, the proprietary AI-native defense platform.
Modern network architecture faces twin pressures from increased machine-to-machine traffic driven by generative tools and sophisticated attackers leveraging automated reconnaissance to accelerate lateral movement. Data from the 2026 Sophos State of Ransomware report demonstrates the strategic value of perimeter intelligence: in 61 percent of analyzed attacks, firewalls flagged anomalies prior to data encryption, providing early alert signals that facilitated coordinated quarantine across other points of presence.
Securing networks in this operational climate relies on matching rising bandwidth needs with real-time defensive synchronization. Daniel Cole, senior vice president of product management at Sophos, emphasized that modern enterprises must manage dense encrypted traffic and programmatic automation without compromising threat response. The updated portfolio aims to eliminate trade-offs between innovation and containment by channeling network-level telemetry directly into active mitigation protocols.
Sophos Firewall v23 introduces central administrative utilities designed to streamline policy governance across cloud and on-premises deployments. Native integration with Sophos AI Defense provides granular oversight of generative tool utilization, enabling teams to sanction enterprise applications while restricting unapproved resources. Administrative efficiency is further reinforced by an automated configuration assistant and modern REST application programming interfaces targeted at managed service providers.
Platform reliability features prominently in the v23 release, highlighted by hardware-aware failover mechanisms that reduce high-availability switchover intervals from four seconds to 300 milliseconds. Foundational security additions include support for DNS over HTTPS, DNSSEC protocol verification, elevated CVE patch tracking, and system-level hardening.
The expanded hardware roadmap includes four high-capacity 1U units: the XGS 2380, XGS 3380, XGS 4580, and XGS 5580. The appliances yield up to four times greater protected throughput than previous iterations, topping out at 59 gigabits per second in threat protection, 16 gigabits per second in TLS traffic inspection, and port connectivity reaching 25 gigabits per second on upper-tier units.
Expanding on traditional passive monitoring, the standalone Sophos NDR deployment merges behavioral pattern recognition with deep packet inspection. When configured in active inline mode, the system drops malicious packets directly along the data path prior to delivery. Hardware support is supplemented by the dedicated NDR 5500 appliance.
Complementary enhancements include Xstream Plus, a consolidated licensing tier packaging protection suites, premium technical support, and extended audit logs. Additionally, workspace policy synchronizations allow IT managers to deploy unified filtering parameters across firewalls, managed browsers, and physical endpoints from a shared administrative console.
Sophos Firewall v23, Xstream Plus licensing, and the new XGS models are available immediately, with standalone NDR implementations slated for deployment on 10 November.