Sophos Launches AI Defense to Expose Shadow AI and Secure AI Use in Real Time

Generally available today, Sophos AI Defense turns the endpoint, network, identity, and browser controls organizations already run into real-time guardrails for AI use

OXFORD, United Kingdom, Oct. 13, 2026 (GLOBE NEWSWIRE) -- Sophos, a global cybersecurity leader, today announced the general availability of Sophos AI Defense, which finds the AI tools employees and applications are using, including the ones security teams never approved, and enforces policy wherever they run. Every AI tool an organization can’t see is a potential gap in confidentiality, integrity, and availability. Delivered through Sophos Fusion, the AI-native cybersecurity defense system, Sophos AI Defense connects controls on the device, across the network, at sign-in, and in the browser into one line of defense, so teams can safely adopt AI faster without adding another disconnected tool to manage.

Attackers see the same opportunity in AI that businesses do. This year alone, Sophos X-Ops has tracked an attacker using AI agents inside a customer’s network to build and test nearly 80 malware modules; threat actors selling brokered API keys for frontier AI models; underground forums trading jailbreak techniques; and criminal recruiters seeking AI prompt engineers.

Most organizations already have AI running that they never approved. Sixty-nine percent suspect or have evidence that employees are using unsanctioned Agents and AI tools,¹ 82% have discovered shadow AI agents in their environments in the past year,² and 90% of IT leaders are concerned about shadow AI risk.³ The problem is about to scale, with IDC projecting 1.3 billion AI agents by 2028.⁴

Each of those agents and tools is both a new attack surface and a new way for sensitive data to leave the business. Sophos AI Defense pulls signals from the device, network, identity, and browser layers to map AI activity across an environment, then weighs who is acting, how they’re behaving, and what data is involved to separate routine use from activity that warrants action. Real-time guardrails, designed to help prevent sensitive data exposure, inspect prompts, uploads, and other AI interactions as they happen. That activity also flows into the Sophos Fusion system, so security teams using Sophos XDR, along with Sophos MDR analysts, can investigate and respond through the workflows they already know.

“Organizations are adopting AI faster than they can secure it, and most security teams can’t answer three basic questions: which AI tools are running, what data is going into them, and whether that activity lines up with policy,” said Kyle Falkenhagen, senior vice president of product management, Sophos. “Sophos AI Defense gives security teams that visibility and the control to act on it, so they can say yes to AI and know exactly what they’re saying yes to.”

Because Sophos AI Defense runs on Sophos Fusion, under-resourced security teams can activate AI security from day one, and managed service providers (MSPs) gain a new capability to deliver across their customer base. The launch comes during Cybersecurity Awareness Month, as safe AI adoption moves up the agenda for organizations of every size.

“Our customers started asking how we were using AI and how we were protecting it,” said Anthony Bender, CTO at Empyreal Logistics. “We didn't have a good answer. We had no way to block and regulate the use of unsanctioned AI tools. We now have a handle on how we want our employees to use AI, and we can show our customers we are doing what we are saying. Now when our customers ask, we have a great answer for them.”

Sophos AI Defense is available now.

The full Sophos X-Ops findings are available in the Sophos AI Security 2026 report: https://www.sophos.com/en-us/content/sophos-ai-security-2026-report

For product details, visit https://www.sophos.com/en-us/products/ai-defense.

About Sophos
Sophos, a global cybersecurity leader, defends more than 625,000 organizations worldwide with Sophos Fusion, the industry's first and most complete AI-native cybersecurity defense system: a single, connected architecture where every control point operates as one. Powered by agentic AI and elite human expertise, Sophos detects, investigates, and neutralizes threats before they become business-disrupting events. Working alongside a global ecosystem of managed service providers, resellers, and technology partners, Sophos compounds intelligence from every threat encountered and every environment defended to make every customer's defense stronger than the last. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.

Media Contact
Kelly Archer
Sr. Director, Global PR
press@sophos.com

¹Gartner, “Gartner Identifies Critical GenAI Blind Spots That CIOs Must Urgently Address,” November 19, 2025. Figure from a Gartner survey of 302 cybersecurity leaders fielded March–May 2025.
²Cloud Security Alliance, “Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises,” April 20, 2026 (survey commissioned by Token Security).
³Komprise, “IT Survey: AI, Data & Enterprise Risk,” June 3, 2025. Survey of 200 IT directors and executives at U.S. enterprises of 1,000+ employees.
⁴IDC, “IDC Info Snapshot,” May 2025.