New network security portfolio delivers up to 4X higher protected throughput, faster failover and enhanced visibility and control over enterprise AI usage.
Sophos has unveiled a series of network security innovations aimed at helping organisations manage the growing performance and protection demands of AI-driven environments. The launch brings together Sophos Firewall v23, four new XGS Series appliances, a standalone Network Detection and Response (NDR) offering and enhancements to its wider network security portfolio.
The move comes as AI increases network traffic, encrypted communications and machine-to-machine activity, while also enabling attackers to accelerate reconnaissance, exploitation and lateral movement. Sophos’ 2026 State of Ransomware report found that 60% of Indian organisations affected by ransomware experienced data encryption, compared with 56% globally, highlighting the importance of detecting threats before they escalate.
At the centre of the announcement, Sophos Firewall v23 introduces integration with Sophos AI Defense, providing network-level visibility, reporting and policy enforcement for AI services. Administrators can identify and control the use of generative AI tools, sanction approved services and block unauthorised applications. A new AI Assistant helps administrators understand firewall configurations and draft rules for review, while a REST API enables greater automation.
The release also strengthens network resilience. Hardware-aware high availability delivers 13 times faster failover detection, reducing the detection window from four seconds to 300 milliseconds. Additional security enhancements include DNS over HTTPS, DNSSEC, improved visibility into CVE hotfixes and security updates, and further platform hardening.
“Customers should not have to choose between enabling innovation and strengthening protection.”
— Daniel Cole, Senior Vice President of Product Management, Sophos
The four new 1U appliances — XGS 2380, XGS 3380, XGS 4580 and XGS 5580 — deliver up to four times higher protected throughput than earlier 1U models. The range supports threat protection throughput of up to 59 Gbps, TLS inspection throughput of up to 16 Gbps, and port speeds of up to 25 Gbps on the XGS 3380 and higher models.
Sophos is also expanding its detection capabilities with a standalone NDR offering that combines behavioural detection, deep packet inspection and IDS/IPS capabilities. Its Active Inline mode can drop identified malicious packets before they reach their destination, extending NDR beyond threat visibility to active intervention. A dedicated Sophos NDR 5500 hardware appliance will also be available.
The broader portfolio includes Xstream Plus, a new licensing option combining Xstream Protection, Sophos Workspace Protection licences, Enhanced Plus Support and extended reporting retention. Workspace Protection enhancements introduce synchronised web policies managed through Sophos Fusion, allowing consistent filtering across Firewall, Protected Browser and Endpoint, alongside a dedicated Generative AI web category.
The innovations are designed to strengthen Sophos Fusion, enabling firewalls, NDR, workspace protection, wireless and switching products to share security intelligence and coordinate responses across the network.
Sophos Firewall v23, Xstream Plus and the new XGS hardware models are now generally available. Sophos NDR is scheduled for general availability from November 10, 2026, subject to regional availability and licensing conditions.