On November 4, 2026, Sophos launched a network security package built for a simple but growing problem: AI is making networks busier, more encrypted and harder to see clearly, while attackers are also using AI to move faster. The launch centres on Sophos Firewall v23, four new XGS Series 1U firewall appliances, a standalone Sophos NDR offering, and a new Xstream Plus licence, all tied together through Sophos Fusion, the company’s AI-native cybersecurity defence system. (See Sophos press release.)
Why AI is changing the network
AI traffic is different from ordinary office traffic. Prompts, workflows, data exchanges and API calls create more encrypted, application-rich and machine-to-machine communication. At the same time, Sophos argues, attackers can use AI to speed up reconnaissance, exploitation and lateral movement, narrowing the gap between an exposed weakness and an attack. Its 2026 State of Ransomware research adds a striking detail: in 61% of ransomware attack events, respondents said the firewall generated an alert before data was encrypted. That early signal only helps, though, if it reaches other security controls quickly enough to trigger coordinated containment. (See Sophos’s Securing the AI-Era Network blog.)
The practical tension is familiar to any IT team. Turn inspection off and performance improves but protection weakens. Keep every protection switched on and the firewall can become the bottleneck. Sophos says this launch is designed to remove that trade-off, pairing protected performance with connected defence — network signals shared in real time through Sophos Fusion so endpoint, identity and network controls can respond together. (See CrowdStrike’s AI kill switch.)
Sophos Firewall v23: AI controls, an assistant and faster failover
Sophos Firewall v23 includes more than 30 enhancements, many requested by customers and partners. Its integration with Sophos AI Defense gives administrators network-level visibility, reporting and policy enforcement for AI service use, including controls that sanction trusted generative AI tools and block unapproved services. A new Generative AI web category in Workspace Protection adds more granular control over which AI services users can reach. (See Tencent’s defensive-only Hy4 model.)
For day-to-day administration, v23 adds an AI Assistant that helps administrators understand firewall configurations and draft rules for review — rules that remain disabled until an administrator reviews and enables them. A modern REST API supports greater automation for IT teams, partners and managed service providers, while redesigned rule management aims to make large rule sets easier to handle.
Resilience gets a notable upgrade too. Hardware-aware high availability delivers 13 times faster failover detection, cutting the detection window from four seconds to 300 milliseconds. The release also adds DNS over HTTPS, DNSSEC, greater visibility into applied CVE hotfixes and security updates, and further platform hardening.
Four new XGS appliances: up to 59 Gbps of threat protection
The four new XGS Series 1U appliances are the XGS 2380, XGS 3380, XGS 4580 and XGS 5580. Together they deliver up to four times higher protected throughput than earlier 1U models, with up to 59 Gbps of threat protection throughput, up to 16 Gbps of TLS inspection throughput, and port speeds of up to 25 Gbps on the XGS 3380 and above. Every model includes 2.5G interfaces, and the range expands to ten 1U models rather than replacing existing appliances. (See Sophos community launch post.)
Under the hood, the models use two Xstream FastPath designs. The XGS 2380 and XGS 3380 use a single-CPU design with dedicated FastPath cores reserved on the main processor, while the XGS 4580 and XGS 5580 pair an x86 CPU with a dedicated Xstream Flow Processor. Sophos also highlights better performance per watt, field-replaceable SSDs so only a faulty drive needs to be returned, and improved internal redundant power options — practical details that matter for distributed offices and mid-sized organisations sizing a refresh.
Sophos NDR goes standalone — and can now block, not just watch
Perhaps the most important shift is that Sophos NDR is now available as a standalone solution, rather than only as part of a wider bundle. It combines behavioural detection with deep packet inspection and IDS/IPS capabilities to analyse activity inside the network, including across managed, unmanaged, IoT and other agentless devices that cannot run an endpoint agent.
Its Active Inline mode moves NDR beyond visibility to direct response: it can drop identified malicious packets before they reach their destination. A new Sophos NDR 5500 hardware appliance will also be available. Sophos Firewall v23, Xstream Plus and the new XGS hardware are generally available now; Sophos NDR will be generally available from November 10, 2026, with availability, licensing and regional exceptions applying.
Xstream Plus and Workspace Protection extend security beyond the edge
Xstream Plus is a new Sophos Firewall licensing option that combines Xstream Protection with Sophos Workspace Protection licences, Enhanced Plus Support and extended reporting retention. Workspace Protection enhancements include synchronised web policies, so administrators can define web-filtering profiles in Sophos Fusion and apply them across Firewall, Protected Browser and Endpoint.
For hybrid and remote teams, that matters because work no longer happens only behind the office firewall. Workspace Protection helps secure access to web, SaaS, private applications and AI tools from anywhere, including unmanaged contractor and BYOD devices — and the Generative AI category helps stop sensitive information being shared with unapproved AI services.
What this means for IT teams
Three questions from Sophos’s own guidance are a useful buying checklist. First, can your network maintain performance with protection enabled — not just headline throughput, but TLS inspection and threat prevention switched on? Second, can you see beyond traditional boundaries, including unmanaged devices, SaaS apps and unsanctioned AI tools? (See identity-first secure connectivity for edge AI.) And third, can a network anomaly trigger a coordinated response alongside endpoint, identity and application context, rather than sitting in an isolated alert queue?
Organisations already on Sophos should size any refresh on protected performance, connectivity, resilience and growth headroom, not model numbers alone — Sophos explicitly warns the new models are not one-for-one replacements. Teams on other platforms should weigh whether the standalone NDR and Fusion-connected approach close a visibility gap inside their network, especially where agentless devices are common. As with any vendor launch, the throughput and failover figures are vendor-reported and worth validating in a pilot before a wide rollout.
The bottom line
Sophos’s AI-era network launch is less about a single feature and more about a repositioning: the network as an active, connected defence layer, not just a fast pipe with a firewall at the edge. Firewall v23 adds AI governance and automation, the new XGS appliances add headroom for encrypted traffic, and standalone NDR adds eyes — and a blocking hand — inside the network. For organisations feeling the strain of AI traffic, that combination is worth a serious look, ideally starting with a sizing and pilot conversation with a Sophos partner. (See China’s full-lifecycle AI law.)
Sophos will discuss the launch further at a Securing the AI-Era Network virtual roundtable on November 17, 2026, with CEO Joe Levy, SVP of Product Management Dan Cole and 451 Research chief analyst Eric Hanselman.
