What happened
On Oct 14, Sophos announced general availability of Sophos AI Defense, delivered through its Sophos Fusion platform. It pulls signals from endpoint, network, identity and browser layers to map AI-tool/agent usage across an environment, surfaces unsanctioned ('shadow') AI, and applies real-time guardrails that inspect prompts, uploads and AI interactions to prevent sensitive-data exposure. Findings flow into Sophos XDR and MDR. Backed by Sophos X-Ops threat intel (attacker agents building ~80 malware modules, brokered frontier-API keys, jailbreak trading).
Why it matters
This is a broad-reaching GA from a major endpoint/SOC vendor targeting the #1 enterprise AI-security gap — unsanctioned agents and data exfiltration — wired into an installed base (Sophos Fusion/XDR/MDR) rather than a standalone tool. IDC projects 1.3B AI agents by 2028; Sophos data shows 82% of orgs discovered shadow AI agents in the past year. It gives SMB/MSP-focused Sophos a differentiated AI-governance product in the same category as Zscaler AI Endpoint Security, Okta Agent Gateway, and Descope's Agentic Identity Hub.
Applicability
Sophos Fusion XDR customers and MSPs should evaluate immediately for shadow-AI discovery and DLP-style guardrails on endpoints; security teams standardizing on endpoint/network/identity/browser protection should compare this against Zscaler and Microsoft MXC approaches for AI governance.