Securing the AI-era network: Why performance and defense now belong together 

AI doesn’t operate in isolation. Its prompts, workflows, data exchanges, and API calls all depend on the network. As organizations put AI to work, it adds a new layer of traffic that is increasingly encrypted, application-driven, and machine-to-machine. 

Attackers are using AI too, helping them find weaknesses and act on them faster. The vulnerability you haven’t patched, the unsupported device you’ve forgotten about, or the management interface exposed to the internet can be discovered and exploited sooner. AI is narrowing the gap between exposure and attack. 

The network connects the users, devices, applications, cloud services, workloads, and AI systems that keep your organization running. That makes it one of the first places risk becomes visible and one of the fastest places to act. But only if the network has the performance to inspect demanding traffic, the visibility to recognize suspicious activity, and the ability to coordinate a response. 

Four pressures reshaping today’s networks 

The challenges will be familiar to most IT and security teams. AI is increasing their scale, speed, and operational impact: 

• More demanding traffic. Encrypted, application-rich, and AI-enabled activity requires more inspection capacity. If the firewall becomes a bottleneck, organizations can be forced to choose between stronger protection and acceptable performance. 
• Faster-moving threats. AI can accelerate reconnaissance, vulnerability discovery, exploitation, and other stages of an attack, reducing the time defenders have to respond. 
• More blind spots. Distributed users, contractors, unmanaged and IoT devices, cloud services, and unsanctioned AI tools make it harder to see what is connected and govern how it is used. 
• Less time to respond. Disconnected tools, incomplete context, and manual handoffs make it harder to contain threats before they spread. 

Performance and protection can no longer be planned separately 

This is not a reason to slow AI adoption. It is a reason to reconsider an old network trade-off. Organizations should not have to choose between supporting innovation and maintaining strong protection. Securing the AI-era network requires: 

• Protected performance: enough capacity to inspect encrypted and application-rich traffic with the necessary protections enabled, without slowing the business down. 
• Connected defense: network visibility and signals that strengthen investigation and response, helping security teams recognize and contain threats before they spread. 

Three questions to ask about your network 

Securing the AI-era network is not simply a matter of buying a faster firewall. It means planning performance, visibility, and response together. 

1. Can your network maintain performance with protection enabled? 

Headline throughput tells only part of the story. Capacity planning should reflect the TLS inspection, threat prevention, application control, and other protections you expect to keep switched on. 

2. Can you see beyond traditional network boundaries? 

Users, contractors, SaaS applications, unmanaged devices, and AI services all contribute to your exposure. Your visibility needs to extend across the environments where work now happens. 

3. Can network activity trigger a coordinated response? 

A network anomaly becomes more valuable when your team can investigate it alongside endpoint, identity, application, and threat context, then take action before the threat spreads. 

The goal is a network that can see what is connected, understand what is happening, maintain protection without compromising performance, and help stop threats before they spread. 

How Sophos is helping secure the AI-era network 

Sophos Fusion provides the foundation for our connected approach to cybersecurity, bringing Sophos products, services, and security intelligence together to help organizations see more, understand more, and respond faster. For the network, that means connecting protection, visibility, and context across the places where users, devices, applications, and data come together. 

The latest Sophos network security innovations build on that foundation: 

• Sophos Firewall provides protection and control at key network boundaries. 
• Sophos NDR extends visibility and response deeper into the network. 
• Sophos Workspace Protection helps secure access wherever work happens. 
• Sophos Wireless and Sophos Switch add visibility into connected devices and network segments. 

Together, they extend the Sophos Fusion story into the network, helping organizations maintain performance, reduce blind spots, and respond faster. 

Sophos Firewall v23: More control with less operational effort 

Sophos Firewall v23 helps organizations improve visibility, simplify administration, and strengthen resilience. It includes more than 30 enhancements, many based directly on customer and partner feedback. 

• See and control AI use. Integration with Sophos AI Defense adds network-level visibility, reporting, and policy enforcement for AI services. 
• Simplify firewall administration. The AI Assistant turns plain-language requests into proposed firewall rules that remain disabled until an administrator reviews and enables them. Redesigned rule management and an updated REST API make day-to-day administration and automation easier. 
• Improve resilience. Faster high-availability failover, visible hotfix status, firmware update scheduling, and DNS over HTTPS help organizations maintain protection and availability. 
• Protect more users and applications. Support for Microsoft Entra ID and Google identity providers, together with increased Web Application Firewall scale, helps protect larger and more diverse environments. 

Learn more about Sophos Firewall v23 

New XGS 1U firewall appliances: More performance. More choice. 

We’re also adding four new models to the XGS 1U range: the XGS 2380, XGS 3380, XGS 4580, and XGS 5580. They give mid-sized and distributed organizations more options on price and performance: 

• Keep inspection switched on as traffic grows. Major gains in threat protection and TLS inspection performance, up to four times higher than comparable existing models, give you room to decrypt and protect growing volumes of encrypted traffic. 
• Get more from every watt. Two purpose-built Xstream FastPath designs improve performance per watt, helping lower operating costs over the life of the appliance. 
• Support higher-speed connectivity. 2.5G interfaces come on every new model, with up to 25G fiber on the XGS 3380 and above. 
• Reduce downtime. Field-replaceable SSDs mean only a faulty drive needs to be returned, while the appliance stays in the rack. Improved internal redundant power options add further resilience. 

The new models expand the XGS range rather than replacing the existing appliances. The right choice depends on the protected performance, connectivity, resilience, and growth headroom your organization needs. Your Sophos partner can help you choose and size the right model for your environment. 

Xstream Plus: Expand protection with one firewall license 

Xstream Plus is a new Sophos Firewall term license for organizations that need more than network-edge protection alone. It includes everything in our most popular subscription bundle, Xstream Protection, together with: 

• a model-specific allocation of Sophos Workspace Protection licenses 
• Enhanced Plus Support 
• up to one year of Sophos Fusion Firewall Reporting data retention, depending on traffic volume 

This gives organizations a simpler way to extend secure access and browser-based controls to remote and hybrid users, strengthen support for business-critical deployments, and retain reporting data longer for investigations, trend analysis, and compliance needs. 

Sophos NDR: Find and stop threats beyond the firewall 

Not every threat crosses a firewall, and not every device can run an endpoint agent. Now available as a standalone solution, Sophos NDR analyzes network activity to identify suspicious behavior across managed, unmanaged, IoT, and other agentless devices. It combines AI- and machine learning-powered behavioral detection with deep packet inspection and IDS/IPS capabilities. 

• Reveal activity other controls may miss. Detect suspicious behavior and lateral movement across managed, unmanaged, and agentless devices. 
• Disrupt malicious activity in real time. In Active Inline mode, Sophos NDR can drop identified malicious packets before they reach their target. 
• Deploy it to suit your network. Choose virtual deployment, compatible third-party hardware, or a purpose-built Sophos NDR appliance, with Active Inline, Passive Inline, and SPAN/TAP options. 
• Investigate with broader context. Bring NDR detections and network context into Sophos Fusion alongside information from other Sophos defenses. 

Sophos NDR works alongside Sophos Firewall to provide a more complete view of the network. Sophos Firewall controls traffic at key network boundaries, while Sophos NDR analyzes activity inside the network to identify threats that boundary controls may not see. Both contribute network context through Sophos Fusion. 

Sophos Workspace Protection: Secure access wherever work happens 

Sophos Workspace Protection helps secure how users access web, SaaS, private applications, and AI tools from anywhere, including from unmanaged contractor and BYOD devices. A model-specific allocation of Sophos Workspace Protection licenses is included with Xstream Plus, giving organizations a straightforward way to extend secure access and browser-based controls beyond the office. 

As we connect more Sophos solutions, customers will be able to apply protection more consistently across the network, endpoint, and workspace. New synchronized web policies are an important step in that direction. Administrators can configure web filtering in Sophos Fusion and apply it across Sophos Firewall and Sophos Endpoint. 

A Generative AI web category adds control over which AI services users can access, helping organizations allow approved tools, block unsanctioned services, and reduce the risk of sensitive information being shared inappropriately. Additional policy support for Sophos Protected Browser and Sophos DNS Protection is planned for future releases. 

We’re also extending this connected approach to AI security. Integration between Sophos Workspace Protection and Sophos AI Defense is planned to bring additional visibility and control to how organizations use AI services. 

A more connected view of network risk 

Each solution contributes a different part of the picture. Sophos Firewall provides visibility and control at key boundaries. Sophos Wireless and Sophos Switch show what is connected and where. Sophos NDR identifies suspicious activity inside the network, including on devices that cannot run an agent. Sophos Workspace Protection extends secure access and browser-based controls to users wherever they work. 

Sophos Fusion brings more of this context together, helping security teams investigate activity across the network and coordinate a faster, better-informed response. Instead of treating each network signal in isolation, teams can use it as part of a broader view of risk. 

Prepare the network for what comes next 

AI is making the network more important, not less. It is increasing organizations’ dependence on encrypted, application-driven, and machine-to-machine communication, while giving attackers new ways to find and exploit weaknesses faster. 

The answer is not to slow innovation. It is to build a network that can maintain protection as traffic evolves, reveal activity across managed and unmanaged environments, and turn network signals into faster action. By planning performance, visibility, and response together, organizations can adopt AI with greater confidence without allowing security or user experience to become the constraint. 

Explore what the AI era means for your network 

Join Sophos CEO Joe Levy, Sophos SVP of Product Management Dan Cole, and Eric Hanselman, Chief Analyst at 451 Research, part of S&P Global Market Intelligence, on November 17 for the Securing the AI-Era Network virtual roundtable. 

Hear their perspectives on how AI is changing the role of the network, why performance and security must now be planned together, and how organizations can prepare for threats that move at machine speed. 

Register for the virtual roundtable.

To explore the latest Sophos Firewall, XGS appliance, Sophos NDR, and Sophos Workspace Protection innovations, contact your Sophos partner or visit the relevant product web pages.