Sophos has expanded its network security portfolio with the release of Sophos Firewall v23, new XGS Series appliances and a standalone network detection and response (NDR) offering, as it points to growing network traffic and security risks associated with increased use of AI tools and connected devices.
The company said its 2026 State of Ransomware report found that in 61% of ransomware attack events, respondents reported the firewall generated an alert before data was encrypted. Sophos positioned the new releases as aimed at improving visibility and control at the network layer and increasing throughput for small and mid-sized organisations.
According to Sophos, Firewall v23 adds visibility, reporting and policy enforcement for AI service use, including controls to allow approved generative AI tools and block unapproved services. The release also introduces an AI Assistant intended to help administrators understand firewall configurations and draft rules for review, and a REST API to support automation for IT teams, partners and managed service providers.
Sophos also said Firewall v23 includes changes it described as resilience and “Secure by Design” improvements, including hardware-aware high availability that it said delivers 13 times faster failover detection by reducing the detection window from four seconds to 300 milliseconds. Additional updates listed include DNS over HTTPS, DNSSEC, visibility into applied CVE hotfixes and security updates, and further platform hardening.
“AI is raising the stakes for the network. Organisations need to support more encrypted traffic, applications, and automated activity while defending against attacks that can move faster and exploit gaps at greater scale,” said Daniel Cole, senior vice president of product management at Sophos. “Customers should not have to choose between enabling innovation and strengthening protection. This launch helps organisations keep pace with growing network demands while turning network visibility and intelligence into faster, coordinated defense through Sophos Fusion.”
The new XGS Series 1U appliances include the XGS 2380, XGS 3380, XGS 4580 and XGS 5580. Sophos said the models deliver up to four times higher protected throughput than earlier 1U models, with up to 59 Gbps threat protection throughput, up to 16 Gbps TLS inspection throughput, and port speeds of up to 25 Gbps on the XGS 3380 and above.
For NDR, Sophos announced a standalone offering combining behavioural detection with deep packet inspection and IDS/IPS capabilities, including an “Active Inline mode” designed to drop malicious packets before they reach their destination. Sophos said an NDR 5500 hardware appliance will also be available.
The release also includes Xstream Plus, a new firewall licensing option that bundles Xstream Protection, Sophos Workspace Protection licences, Enhanced Plus Support, and extended reporting retention. Sophos also announced Workspace Protection updates, including synchronised web policies across firewall, protected browser and endpoint, and a new “Generative AI” web category.
Two customer statements were included in the announcement, with Velocity1 and Fairstone Group commenting on compliance requirements and centralised policy management across multiple network devices.
Sophos said Sophos Firewall v23, Xstream Plus and the new XGS hardware models are generally available now, while Sophos NDR is expected to be generally available from November 10. The company noted that availability, licensing and regional exceptions may apply.
