In short: Sophos AI Defense is a paid add-on for eligible Sophos EDR, XDR and MDR customers on Sophos Fusion, generally available since October 2026. It discovers sanctioned and unsanctioned AI tools in use, weighs activity by user, behaviour and data involved, applies central AI usage policies through supported Sophos products, and reports on AI use through dashboards.
What is Sophos AI Defense?
Staff are using generative AI chatbots, writing assistants, browser plug-ins and AI features built into everyday apps, often without IT knowing. That is shadow AI. The risk is not the tools themselves but what goes into them: customer data, contracts, source code or personal information pasted into a service your organisation has never assessed.
Sophos AI Defense (the product name uses the US spelling) gives you visibility and control of that activity. Sophos announced general availability on 13 October 2026, during Cybersecurity Awareness Month, as part of Sophos Fusion. It extends Sophos products you may already run, such as Sophos Endpoint, Sophos Firewall and Sophos Workspace Protection, and is managed in the same console.
What Sophos AI Defense does
| Capability | What you get |
|---|---|
| Discovery | Finds the AI tools, agents and workflows in use across users and devices, both approved and unapproved |
| Shadow AI visibility | Highlights unsanctioned AI services and where data may be exposed to them |
| Risk context | Weighs who is using a tool, how they are behaving, their permissions, location and the data involved, so routine use can be told apart from risky use |
| Policies | Central AI usage policies and guardrails, applied through supported Sophos security products |
| Dashboards and reporting | Central dashboards and reports on AI usage and exposure, useful for management and risk discussions |
| Investigation | AI-related activity flows into Sophos Fusion, where Sophos XDR users and Sophos MDR analysts can investigate and respond |
What is on the roadmap, not yet confirmed
Sophos's launch messaging talks about guardrails that inspect prompts and uploads, but its partner material lists prompt inspection and protection, telling personal from business AI accounts, and further AI agent security as future capabilities, subject to change. Until those are confirmed for your tenant, treat AI Defense as a visibility and access-control tool rather than full data loss prevention for AI prompts.
How it works
Sophos says AI Defense pulls signals from the device, network, identity and browser layers, then joins them up in Sophos Fusion. In practice it extends Sophos products you may already have:
- Sophos Endpoint on user devices, through the Sophos EDR tier or higher
- Sophos Firewall for the network layer
- Sophos Workspace Protection, which includes the Sophos Protected Browser, for the browser layer
- Sophos MDR, whose analysts can investigate AI-related activity
The more of these you run, the more complete the picture and the more places a policy can be applied. We recommend a pilot to confirm which controls apply to the AI tools and access routes your staff actually use.
Eligibility and licensing
- Paid add-on for eligible Sophos EDR, Sophos XDR and Sophos MDR customers
- Sophos Fusion required: your account needs to be on the upgraded Fusion security operations platform; Sophos is moving tenants in phases
- Not with Sophos Endpoint alone: customers on the base Sophos Endpoint tier need to move up to EDR or above
- Taegis customers: Sophos said eligible Secureworks Taegis customers can buy at general availability without waiting for a Fusion migration
Ask us for a quote. We will also check whether your tenant has been upgraded yet.
UK context: UK GDPR and data leaking into AI tools
Under UK GDPR, putting personal data into an external AI service is processing, and possibly an international transfer. You need a lawful basis, an understanding of what the provider does with the data, and records to show you are in control. The Information Commissioner's Office has published guidance on AI and data protection that is worth reading alongside your own AI policy.
Technology is only half the answer. A practical approach is:
- Use AI Defense to find out which AI tools are already in use
- Decide which tools are approved, and on what terms, in a written AI acceptable-use policy
- Apply AI usage policies in Sophos Fusion that match that decision
- Train staff on what must never go into an AI tool; see our security awareness training site
- Review the dashboards regularly and update the policy as new tools appear
How we help
We check eligibility, run a discovery pilot, turn the results into a short report on AI use across your organisation, and help you set policies that people can live with. If you are not yet on Sophos EDR, we will quote for the move.
Contact us to get started.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is shadow AI?
Shadow AI is the use of AI tools and services, such as chatbots, writing assistants and AI browser extensions, that the organisation has not approved or assessed. The main risk is sensitive or personal data being shared with services outside your control.
Which Sophos licences can use Sophos AI Defense?
It is a paid add-on for eligible Sophos EDR, Sophos XDR and Sophos MDR customers on Sophos Fusion. Sophos Endpoint on its own does not qualify.
Can Sophos AI Defense block ChatGPT and other AI tools?
Sophos AI Defense lets you manage AI usage policies centrally and apply supported controls through Sophos security products such as Sophos Endpoint, Sophos Firewall and Sophos Workspace Protection. Which controls apply depends on the products you run, so we test policies for specific tools, such as ChatGPT, in a pilot first.
Does Sophos AI Defense inspect what people type into AI tools?
Sophos lists prompt inspection and protection as a roadmap capability, subject to change. Today, plan around discovery, risk context, policy control and reporting.
Why is it spelt Defense?
Sophos AI Defense is the product's official name, which uses the US spelling. We use the UK spelling, defence, everywhere else.