Sophos brings endpoint, network, identity, email, and cloud security together into a single system: Fusion. The platform uses a shared data and AI layer to detect and handle incidents faster.
Sophos is introducing a new security technology. Fusion aims to provide an answer to an increasingly complex security landscape, said CEO Joe Levy during a press briefing. “Organizations have too many security tools, 45 on average. Global spending on security technology is rising, but it isn’t leading to better security. Vendors are trying to consolidate, but they aren’t integrating with each other.”
We’ve been hearing for quite some time now that there’s an oversupply of security technology and that no single platform can cover the entire spectrum. Sophos is certainly not the first vendor to claim that it’s the only one capable of doing so. According to the company, Fusion isn’t just another platform, but a complete and integrated “security system” where the various layers come together.
Shared context for faster response
Sophos Fusion is the successor to Sophos Central. Fusion collects signals from control points in real time into a single shared data layer, where AI agents stand ready to spring into action. “AI is not a feature, but the architecture that connects everything,” says Chief Product Officer Raja Patel. Consequently, detections on an endpoint can also trigger actions in firewall, cloud, email, or identity security. The platform works with both Sophos products and tools from other vendors.
More than 500 external integrations can send data to the system. Sophos states that organizations can thus retain existing endpoint, firewall, and identity tools while simultaneously incorporating them into a broader defense. Analysts determine the boundaries within which AI agents investigate and respond. “Humans should not be in the loop, but on the loop. Without human control, you destroy accountability,” Patel adds.
Sophos also uses the technology in its own SOC. According to the company, AI handles 52 percent of incidents entirely. The average time between an alert and a full response is 89 seconds, spread across more than 40,000 customers.
Extensions
Sophos will release an initial version of Fusion starting in August, though it will not yet contain all capabilities. Between August and October, Sophos will gradually add new features. These include ‘Next-Gen SIEM’, more extensive MDR, and a rebuilt XDR based on Secureworks Taegis.
An overview of what Sophos still plans to add to Fusion:
- Next-Gen SIEM offers long-term data retention, compliance reporting, and analytics. Sophos links the price to users and servers, not to data volume. This would allow organizations to ingest all telemetry without costs rising due to larger data volumes.
- Sophos MDR will feature 24/7 threat hunting supported by the X-Ops research team. The service can respond via endpoint, firewall, cloud, email, and identity. With this, Sophos is targeting companies that do not want to or cannot build their own SOC.
- Sophos XDR will feature thousands of detectors, automation with playbooks, and a new environment for analysts.
- AI Defense will first appear in preview and will be more widely available from October. The service is intended to provide visibility into used AI tools, including unauthorized AI use, and help organizations enforce policies and protect data.
- CISO Advantage combines control validation, compliance links, benchmarking against other organizations, and risk assessments. Sophos is also targeting organizations without their own CISO and managed service providers.
One platform for partners
For partners, Fusion bundles individual products into a single system for sales and management. Sophos expects that managed service providers will thus be able to offer advice on risks and security policies alongside technical services.
Furthermore, the shared threat intelligence should benefit every connected customer whenever Sophos notices an attack elsewhere. Whether Fusion actually succeeds in reducing complexity and the number of security tools in organizations will only become clear once the system reaches its full capacity.
Identity as the greatest vulnerability
Alongside the launch of Sophos Fusion, the company is also sharing its latest ransomware report. It will come as no surprise that this shows ransomware remains one of the greatest threats to organizations. However, the way attackers carry out ransomware attacks has changed.
79 percent of ransomware attacks start with compromised identities, Sophos finds. Software vulnerabilities are no longer the most common vector for ransomware: phishing is taking over that role. “People are being exploited at least as often as software,” explains Sophos researcher Alex Rose regarding the shift.
In many cases, MFA proved insufficient to stop the attacks, demonstrating that MFA alone is not enough to keep your organization safe. Identity must become a core component of security.
Higher spending on security does not lead to better security.
Joe Levy, CEO Sophos
Preventive Measure
There is also positive news, as organizations are making progress in their ability to recover from attacks. More than half (55%) of organizations can resume operations after a week, and 16 percent even after just one day. The importance of backups seems to be gradually sinking in within the business world. Large companies, however, remain more effective at stopping and recovering from attacks than small companies.
Whether bolstered by backups or not, companies are also taking a firmer stance in negotiations following an attack. 48 percent of companies agree to attackers’ demands. That still seems like a lot, but it is the second-lowest percentage in the seven years Sophos has been conducting its research. 51 percent succeed in getting the ransom lowered. The median ransom demand has dropped by 65 percent in two years, meaning criminals are also aiming lower.
“The impact of ransomware remains high and is accelerating with AI. Attacks are not isolated and play out across multiple layers. Companies are also concerned about their supply chain because they cannot control it. Security technology must see the whole picture and act accordingly, rather than working in a fragmented way,” Rose concludes.