Sophos overhauls network security portfolio with Firewall v23, high-performance XGS hardware, and standalone NDR for MSPs
Sophos has announced a major expansion of its enterprise and channel security portfolio, anchored by the launch of Sophos Firewall v23, four new high-throughput XGS Series 1U hardware appliances, and a dedicated standalone Network Detection and Response (NDR) solution.
Designed specifically to tackle the complexities of the AI era, where automated threats move laterally and encrypted traffic volumes continue to surge, the update gives managed service providers (MSPs) advanced tools to secure unmanaged devices, automate administration, and scale network margins.
Sophos Firewall v23 and High-Performance XGS Hardware
At the center of the hardware refresh are four new 1U XGS Series appliances engineered with custom Xstream FastPath silicon architecture. These units deliver up to 4X higher protected throughput than predecessor models, ensuring that businesses can keep TLS inspection enabled without sacrificing network performance.
Key software and operational enhancements in Sophos Firewall v23 include:
AI-Powered Administration: Features a built-in AI Assistant that translates plain-language administrative requests into proposed firewall rules for human review, alongside a modernized REST API designed to streamline partner automation.
Granular AI Application Controls: Integrates directly with Sophos AI Defense, giving IT administrators real-time visibility and policy enforcement to sanction approved generative AI services or block unauthorized corporate shadow-AI tools.
Enhanced Resilience: Delivers hardware-aware High Availability (HA) with failover detection slashed from four seconds down to 300 milliseconds, alongside field-replaceable SSDs and support for DNS over HTTPS (DoH).
Standalone Sophos NDR for Complete Internal Visibility
Built to address threats that bypass network perimeters or target devices incapable of running endpoint agents, the new standalone Sophos NDR offering provides deep internal network visibility.
Behavioral Detection & Deep Packet Inspection: Combines machine learning-based behavioral analytics with deep packet inspection (DPI) and IDS/IPS to unmask lateral movement and suspicious internal traffic.
Active Inline Mitigation: Unlike passive monitoring tools, Sophos NDR features an Active Inline mode capable of dropping malicious packets in real time before they reach their targets.
Flexible Deployment Options: Available via virtual deployments, compatible third-party hardware, or dedicated Sophos appliances utilizing Active Inline, Passive Inline, or SPAN/TAP configurations.
Unified Telemetry via Sophos Fusion
All new network telemetry feeds directly into Sophos Fusion (the evolution of Sophos Central), allowing MSPs to correlate firewall blocks, endpoint telemetry, and standalone NDR detections into a single pane of glass. This integrated ecosystem approach enables security operations teams to automate cross-product containment workflows, transforming routine hardware renewals into high-margin, intelligence-led managed service agreements.
