AI-era network security is turning into a tougher balancing act for organisations. More traffic, more encryption and more automated activity now run through the same networks that attackers are probing with AI tools. Cybersecurity company Sophos unveiled a refresh of its network line-up on Tuesday (10 November), led by Sophos Firewall v23, new XGS hardware and a standalone network detection and response (NDR) product.
Why AI-Era Network Security Is Getting Harder
Users, applications, cloud services and AI systems are all adding to network load, including a growing share of machine-to-machine traffic. Attackers, meanwhile, can use AI to speed up reconnaissance, exploit weak spots faster and move sideways once they get inside.
The network can still act as an early warning system. In Sophos’s 2026 State of Ransomware report, respondents said the firewall raised an alert before data was encrypted in 61% of ransomware attack events.
“AI is raising the stakes for the network,” said Daniel Cole, senior vice president of product management at Sophos. He added that customers should not have to pick between enabling innovation and strengthening protection.
For more on how attackers are using AI, see our earlier look at how agentic AI is reshaping cyberattacks.
Inside Sophos Firewall v23
The firewall update puts more focus on how staff use generative AI at work. Through integration with Sophos AI Defense, IT teams get network-level visibility and reporting on AI services, along with policy controls to approve trusted tools and block unapproved ones.
Administrators also get an AI Assistant that explains firewall configurations and drafts rules for human review. A new REST API is aimed at IT teams, partners and managed service providers (MSPs) that want to automate more routine work.
Resilience is the other focus. The company says hardware-aware high availability now detects failover 13 times faster, cutting the detection window from four seconds to 300 milliseconds. The release also adds DNS over HTTPS, DNSSEC, clearer visibility of applied CVE hotfixes and security updates, and further platform hardening.
4 More Upgrades Beyond the Firewall
Sophos Firewall v23 is one of five pieces in the launch. The other four are:
- New XGS 1U appliances: The XGS 2380, 3380, 4580 and 5580 offer up to four times the protected throughput of earlier 1U models, with up to 59 Gbps of threat protection, up to 16 Gbps of TLS inspection and 25 Gbps ports on the XGS 3380 and above.
- Standalone Sophos NDR: It pairs behavioural detection with deep packet inspection and IDS/IPS. An Active Inline mode can drop malicious packets before they reach their target, and a new NDR 5500 appliance is also planned.
- Xstream Plus licensing: One firewall licence that bundles Xstream Protection, Sophos Workspace Protection licences, Enhanced Plus Support and longer reporting retention.
- Workspace Protection updates: Web-filtering profiles set in Sophos Fusion can now apply across the firewall, Protected Browser and endpoint, while a new Generative AI web category gives finer control over AI services.
All of these feed into Sophos Fusion, the company’s connected defence platform. The idea is that the firewall, NDR, wireless, switches and workspace tools share context, so a threat spotted at one point can be contained across the rest. For AI-era network security, that shared view matters as much as raw speed.
What It Means for Malaysian Organisations
For Malaysian companies, the timing lines up with tighter expectations at home. The Cyber Security Act 2024, in force since August 2024, requires operators of national critical information infrastructure to follow codes of practice and report cyber incidents. That puts more weight on early detection, consistent policies and clear audit trails, which is where AI-era network security tools are now competing.
MSPs are also central to how many small and mid-sized firms buy protection. Paul Gibbs, VP of managed IT at Velocity1, an MSP serving defence contractors and other regulated industries, said his team runs the same tools internally that it deploys for clients, and that Firewall v23 and Xstream Plus help it streamline operations across mixed environments.
Aaron Carrier, director of infrastructure and cyber security at Fairstone Group, pointed to a more everyday problem. Managing dozens of firewalls, switches and access points one by one “isn’t sustainable”, he said, and central management keeps policies consistent across the network.
Availability
Sophos Firewall v23, Xstream Plus and the new XGS models are available now, while Sophos NDR becomes generally available from 10 November. Availability, licensing and regional exceptions may apply. Details are on the Sophos Firewall and Sophos NDR pages.
