Sophos brings AI investigation into its Fusion security workspace

Sophos combines endpoint and network security with AI investigation and managed response. Compare assistant access, telemetry and operational fit.

01 / ProductFusion connects security products, investigation and services

Sophos sells endpoint, network and security operations products alongside managed detection and response. Its current documentation calls the administration workspace Sophos Fusion; older material still refers to Sophos Central. The useful AI question is how a security team gets from an alert to a defensible action. The Sophos XDR offering provides an investigation environment, while the assistant helps people interpret and query evidence already available to that environment.

The Sophos AI assistant documentation separates Security Analyst, Threat Hunter and Firewall Assistant. Security Analyst starts with an existing case; Threat Hunter explores Data Lake evidence for Self-managed cases only; Firewall Assistant helps with policies on Sophos firewalls running SFOS 23.0 or later. These entry points should lead to different evaluation tasks. A case summary, an exploratory search and a firewall configuration proposal require different evidence and different reviewers.

Sophos completed its Sophos Secureworks acquisition in February 2025, bringing the Secureworks business into the company. That matters when comparing old Taegis or Secureworks material with a new Sophos proposal: ask which service and console the order actually covers. For a buyer, the practical issue is which Sophos service will operate the investigation and what evidence its console makes available.

02 / AudienceA useful starting point is a recurring investigation bottleneck

An IT team may have capable protection on its machines but still spend too long explaining an unusual process to the next analyst. Sophos is worth considering when the delay is repeated evidence gathering: identifying the device, checking the user, understanding a command and preserving a case narrative. Existing Sophos customers can assess that task before considering a platform replacement.

A staffed security operations team and an organisation relying on managed response should evaluate different responsibilities. In the first, the team owns the investigation queue and response decisions. In the second, it needs clarity about what the provider has investigated, what requires local approval and who will contact the affected business owner. An assistant interface does not itself create that service relationship.

For organisations already using Falcon, CrowdStrike is a relevant comparison for investigation agents operating within an existing security platform. SentinelOne offers another context for AI-assisted security operations. Compare evidence access and responsibility for the next action before comparing the fluency of generated explanations; a persuasive answer based on incomplete telemetry is still incomplete.

03 / WorkflowProposed workflow: explain a suspicious administrative process

Use an authorised test environment and choose a benign administrative activity that resembles the sort of alert your team normally investigates. Record the expected device, initiating account, time window and approved change ticket before running the exercise. This is a proposed evaluation, not a completed Sophos test or a claim about detection accuracy.

Open the resulting case and ask for a short explanation of the observations. Keep the request bounded to the known host and period. Then ask what evidence supports the interpretation and what remains unknown. Compare the answer with the original detection and event timestamps. The success condition is a reviewable explanation that saves effort without hiding a gap.

Use a separate hunting question to look for related activity in the available Data Lake. Require the reviewer to distinguish a query with no matches from a query that could not reach the required data. A missing machine, retention gap or unsupported event type can otherwise look like a reassuring absence of suspicious behaviour.

Build the handover from verified observations. Put the process, device and time window first, then the analyst assessment and next action. The documented notebook feature is useful here: selected responses can be saved to a case for other authorised administrators to read. Treat the saved response as supporting material, with the responsible analyst adding the final disposition.

Keep containment as an explicitly authorised operational step. For this investigation assistant, the FAQ says remediation remains human initiated. In the exercise, require the operator to confirm the target device and expected business impact before using the relevant security control. Read back the result and record whether the device was reachable and whether the intended change completed.

Finally, repeat with an ambiguous but legitimate activity and with deliberately unavailable evidence. Measure the time needed to verify the answer, incorrect assertions, omitted uncertainty and handover completeness. An assistant that produces a long report quickly may still increase workload if the reviewer has to reconstruct every claim. Evaluate the full investigation, not generation speed alone.

04 / PricingAssistant entitlement and request limits need separate checks

The Sophos AI features FAQ lists XDR, MDR, MDR Plus and Network Detection and Response as qualifying licences for full AI features, including the assistant; EDR has narrower access. The Sophos AI Assistant enhancements says the assistant is included for XDR and MDR customers without an additional charge. This does not make the underlying products free or establish a universal per-device tariff.

The Sophos AI responsible use limits describes rolling 24-hour caps by tenant and user. For assistant messages, the documented limits are 1,000 per tenant and 200 per user; conversational threads have separate caps. Reaching a cap temporarily pauses the affected feature. A pilot should therefore count follow-up messages and concurrent analysts, especially during an incident surge.

Ask for the commercial proposal to identify protection products, investigation capabilities, retention and any managed service separately. The relevant comparison is the cost of the intended operating arrangement over its contract period. Currency, device or user counts, renewal conditions and response scope should come from the actual regional quote, not an unrelated endpoint bundle.

05 / DistinctionsThe handover mechanism matters as much as the chat

Sophos places the assistant near cases and investigation evidence, which can make a useful operational difference. A question can start from an incident rather than a manually assembled prompt. The analyst can then decide which responses belong in the case record. That creates a practical boundary between exploratory conversation and the material colleagues will rely on later.

The distinction also exposes a training requirement. Analysts need to know when they are asking for facts about a case, interpreting an event or proposing a policy change. Those requests carry different consequences. A repeatable prompt template can reduce accidental scope changes, but it should remain an aid to the analyst rather than a substitute for understanding the investigation.

06 / QuestionsResolve source coverage before relying on broad platform language

The current FAQ specifically lists Windows endpoint and server evidence for assistant retrieval, while newer assistant instructions describe an additional firewall workflow. That is a reason to verify each assistant and data source in the proposed tenant. Broad XDR integration coverage should not be read as proof that every connected source is available to every AI workflow.

The same documentation requires Admin or Super Admin access and recommends checking generated content for accuracy. Its investigation FAQ says the assistant does not directly remediate threats. Keep that statement separate from broader Sophos managed-service automation claims. Establish what the particular feature does before giving an operator a procedure based on the wider marketing description.

For a shared case, private chat history and saved notebook content have different audiences. Test that distinction with the actual support roles and escalation route. Preserve the required case evidence before deleting an exploratory conversation. Public documentation research cannot establish how well the model handles your incident types, whether a firewall proposal is suitable or how quickly your contracted service will respond.

07 / DecisionChoose the operating relationship before expanding AI use

Sophos is a sensible shortlist candidate when its security products and service model match the organisation, and the assistant addresses a concrete investigation delay. Start with a case type that can be reviewed consistently. Expand only when analysts can verify the evidence, understand entitlement limits and hand the result to the next person without losing context.