In short: Sophos Fusion is the evolution of Sophos Central, launched by Sophos on 15 July 2026. It is not a separate product, SKU or licence but the AI-native platform and console where Sophos products are managed. Existing workflows carry on, the new name appears in consoles gradually, and existing tenants move to the enhanced XDR, MDR and SIEM experience in phases.
What is Sophos Fusion?
Sophos launched Sophos Fusion on 15 July 2026. Sophos describes it as the evolution of Sophos Central, its cloud management console, rebuilt as what it calls an AI-native cybersecurity defence system on one open architecture. Put simply, it is the place where your Sophos products are managed, where their data comes together, and where detections are investigated and acted on.
Three points cause most of the confusion, so it is worth being clear:
- It is not something you buy. Sophos says Fusion is not a separate product, SKU or platform, and there is nothing extra to license to turn it on. You get it by owning Sophos products, from Sophos Intercept X (now sold as Sophos Endpoint) to Sophos Firewall or Sophos Email.
- It is an evolution, not a replacement. Sophos Central is not being switched off in favour of a different console. Sophos says existing workflows continue, so the same tenant, policies and devices carry on.
- The name changes gradually. Sophos says customers will see the Fusion name in their consoles over the coming months, so for a while you will see both names in emails, help pages and the console itself.
On this site we write Sophos Fusion (formerly Sophos Central) so it is obvious we mean the same console. For day-to-day console tasks, such as policies, alerts, admin roles and data regions, see our Sophos Central page.
What is new in Sophos Fusion
The rename sits on top of real changes underneath. The most significant ones for UK organisations are:
- A shared data layer that brings together telemetry from Sophos products and third-party tools (endpoint, firewall, email, cloud, network and identity), so detections can be correlated rather than reviewed product by product
- Secureworks technology built in. Sophos completed its acquisition of Secureworks in February 2025, and Fusion's architecture incorporates Secureworks Taegis analytics. The enhanced XDR is sold as Sophos XDR Powered by Secureworks (see Sophos XDR)
- Enhanced XDR, MDR and SIEM: the new Sophos XDR, expanded Sophos MDR and Sophos Next-Gen SIEM became generally available to new term (non-MSP) customers in August 2026, with MSP availability to follow and existing tenants upgraded in phases
- AI with human oversight: Sophos says Fusion's agentic AI can act without waiting for a person, but only within boundaries its MDR analysts define and keep calibrated, with AI handling volume and people owning the trust boundary
- Microsoft integration: Sophos says Fusion's Microsoft security integration works across all Microsoft plans, not just E5, so organisations on Business Basic or Business Standard benefit too (see Sophos MDR for Microsoft Defender)
- New products delivered through Fusion, including Sophos AI Defense for visibility and control of AI use, including shadow AI (generally available since October 2026), and Sophos CISO Advantage, which maps your controls to frameworks such as NIST CSF and CIS v8 and produces a prioritised roadmap and reporting for leadership (available from October 2026)
The new console layout
Sophos's admin help (updated September 2026) describes a reorganised console. If you manage Sophos yourself, expect to relearn where a few everyday tasks live:
| Before | In Sophos Fusion |
|---|---|
| Account Health Check under Dashboards, Device Exposure in Threat Analysis Center | Both moved, with Alerts, into a new My Environment section |
| Devices list mostly endpoints and servers | My Environment > Devices also lists firewalls, ZTNA gateways, wireless access points and switches |
| People | Renamed Users & Groups, under My Environment |
| Global Settings under My Products | Opened from the Global Settings icon on the taskbar |
| Linux profiles under Native Cloud Security | Moved to Global Settings (Protection and Remediation) or My Products > Server |
| Sophos Assistant as a separate feature | Inside Sophos Help, under interactive product guides |
| Customer ID shown elsewhere | Shown under your account name when you open the profile menu |
None of this changes your protection, but it does affect internal runbooks, screenshots in IT documentation and any training you give to second-line staff.
What admins need to do
- Nothing to buy or migrate. There is nothing extra to license, and your existing products and workflows carry on. Do not let anyone sell you a "Fusion licence".
- Watch for upgrade notices. Existing EDR, XDR and MDR customers are moved to the enhanced experience in phases, with an in-product notice before each upgrade.
- Check your integrations after the upgrade. Confirm that Microsoft 365 and other third-party integrations still show as healthy, and act on any in-console notice asking you to reauthorise one.
- Update runbooks and bookmarks for the new navigation, and tell anyone who uses the console occasionally.
- Run Account Health Check under My Environment and fix anything below 100, so the protection you pay for is switched on.
- Review admin roles and MFA for every console account. Sophos requires MFA for Sophos Fusion account administrators, and the console now reaches more of your estate.
If your tenant is managed by us, we handle these steps and tell you if anything needs your sign-off, such as a Microsoft 365 administrator consent.
Who Sophos Fusion matters to
- Existing Sophos customers, who need to understand the rename and the phased upgrades, but do not need to change contracts
- EDR, XDR and MDR customers, who get the biggest changes, as their tenants move to the enhanced XDR and MDR experience in phases
- Organisations comparing platforms, who should judge Fusion by what the products in it do, because the console itself is not priced
- Former Taegis customers, who can read our Secureworks Taegis page for how the two platforms relate
For a vendor-neutral view of endpoint, XDR and MDR options, see endpoint security and XDR on our cloud security site.
How we help
We supply Sophos licences, run Sophos Fusion tenants for UK organisations and help in-house teams through the changes. That includes checking the upgrade status of your tenant, reauthorising integrations, tidying policies and admin roles, and explaining which new add-ons, if any, are worth paying for.
Want a review of your Sophos Fusion tenant, or a quote for new Sophos products? Contact us.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Sophos Fusion a new product?
No. Sophos says Fusion is not a separate product, SKU or platform, and there is nothing extra to license to turn it on. It is the evolution of Sophos Central, the console and platform where Sophos products are managed, and you get it by owning Sophos products.
Is Sophos Central being discontinued?
Not in the sense of being switched off. Sophos Central is evolving into Sophos Fusion: Sophos says existing workflows continue, and the new name appears gradually in the console and Sophos communications.
When was Sophos Fusion launched?
Sophos launched Sophos Fusion on 15 July 2026. The enhanced XDR, MDR and Next-Gen SIEM became generally available to new term (non-MSP) customers in August 2026, with existing tenants upgraded in phases.
Do I need to pay more for Sophos Fusion?
No. There is no Fusion licence. You pay for the Sophos products and services you use. Some new capabilities, such as Next-Gen SIEM and AI Defense, are separately licensed subscriptions, but they are optional.
What do I need to do when my tenant moves to Sophos Fusion?
Mostly nothing. Watch for in-product upgrade notices, check Microsoft 365 and other integrations still show as healthy (reauthorising any the console asks you to), and update internal guides for the new console layout.