Sophos Central

No entries match these filters. Clear filters

1. changelog Oct 12, 2026 · issue 105

   Sophos Central adds AI agent identity visibility, Dark Web Monitoring domain verification, phishing protection in Protected Browser, and transaction re-auth for sensitive ops⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Confirm an updated exclusion policy has reached a specific endpoint before assuming it is protected.
   📍In Sophos Central, open the endpoint's details page, select the Policies tab, and check the Application status column for the relevant policy to see when the change was applied.
   • Surfaces every AI agent, blueprint, and app created by Microsoft Entra — including owner and sponsor — under Non-Human Identities in the Directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds manual domain entry and DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record ownership verification for Dark Web Monitoring, removing the requirement to sync domains from Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
   • Delivers Phishing Protection in Protected Browser to guard organizational credentials, adds direct DNS Protection independent of endpoint or network policies, provides a new MSI installer for easier Windows deployment of Protected Browser, and adds more flexible data boundary controls.
   • Requires administrators to re-authenticate before running Live Response and sensitive Response Actions via transaction authentication.
   • Shows application status for each policy on the Policies tab of an endpoint's details page, so admins can confirm when an updated policy has taken effect.

   +5 more show less

   • Scales bulk endpoint actions on the Computers and servers page to tens of thousands of devices, with long-running actions continuing in the background.
   • Adds alerts for Microsoft Entra ID and Google Directory synchronization — covering successful syncs, warnings, errors, oversized synchronizations, and deactivations — surfaced on the Alerts page.
   • Adds AP6 MR10 firmware support for Microsoft Entra ID authentication and Per-SSID RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. management.
   • Enables scheduling of Entra ID synchronization as frequently as every 30 minutes, with enhanced multi-value operator filtering and selective device-attribute sync.
   • Enables deletion of old, unused on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. sources directly from the Sophos Fusion interface.
   • Surfaces every AI agent, blueprint, and app created by Microsoft Entra — including owner and sponsor — under Non-Human Identities in the Directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds manual domain entry and DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record ownership verification for Dark Web Monitoring, removing the requirement to sync domains from Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
   • Delivers Phishing Protection in Protected Browser to guard organizational credentials, adds direct DNS Protection independent of endpoint or network policies, provides a new MSI installer for easier Windows deployment of Protected Browser, and adds more flexible data boundary controls.
   • Requires administrators to re-authenticate before running Live Response and sensitive Response Actions via transaction authentication.
   • Shows application status for each policy on the Policies tab of an endpoint's details page, so admins can confirm when an updated policy has taken effect.

   +3 more show less

   • Adds alerts for Microsoft Entra ID and Google Directory synchronization — covering successful syncs, warnings, errors, oversized synchronizations, and deactivations — surfaced on the Alerts page.
   • Adds AP6 MR10 firmware support for Microsoft Entra ID authentication and Per-SSID RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. management.
   • Enables deletion of old, unused on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. sources directly from the Sophos Fusion interface.

   2 more in Everything

2. October 12, 2026 Oct 12, 2026 · issue 128

   Sophos Central adds AI agent and non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. visibility in Entra, endpoint policy status, and phishing protection in Protected Browser⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Sophos ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. now surfaces AI agents, blueprints, and apps created by Microsoft Entra — including ownership and sponsorship — under Non-Human Identities in the Directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • See the application status for each policy on the Policies tab of an endpoint's details page, including confirmation that updated policies (such as exclusions) have been applied.
   • Protected Browser now adds Phishing Protection to guard organizational credentials, direct DNS Protection independent of endpoint or network policies, a new MSI installer for Windows deployment, and more flexible data boundary controls.
   • Sophos ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. now surfaces AI agents, blueprints, and apps created by Microsoft Entra — including ownership and sponsorship — under Non-Human Identities in the Directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • See the application status for each policy on the Policies tab of an endpoint's details page, including confirmation that updated policies (such as exclusions) have been applied.

   1 more in Everything

3. changelog Sep 5, 2026 · issue 065

   Sophos ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. gains on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. support, a redesigned Identity Overview dashboard, and posture check filtering.

   • Adds on-premises Active Directory (AD) support to Sophos ITDR — deploy the new sensor to an AD server to extend monitoring and posture assessments beyond cloud identity.
   • Redesigns the Identity Overview dashboard with new widgets for risk trends, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. coverage, dormant accounts, credential leaks, and VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. users.
   • Redesigns the Posture Check page with filtering, sorting, and searching by category, provider type, and status, plus tag chips, a live match counter, and a NEW badge for recently published checks.
   • Rolls out an updated threat protection policy page with a clearer layout, filters, and the option to add explanatory notes to settings and exclusions.
   • Adds guided ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. workflows for securing SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps via Protected Browser, including data boundaries, device posture checks, and in-browser RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. and SSH access under the Workspace Protection license.
   • Adds on-premises Active Directory (AD) support to Sophos ITDR — deploy the new sensor to an AD server to extend monitoring and posture assessments beyond cloud identity.
   • Adds guided ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. workflows for securing SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps via Protected Browser, including data boundaries, device posture checks, and in-browser RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. and SSH access under the Workspace Protection license.

   3 more in Everything

4. Latest news seen Aug 17, 2026 · issue 048

   Sophos Central adds AI Defense EAP, ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. Identity Risk Scores, new ITDR regions, and a Generative AI DNS filtering category.

   • Adds a Generative AI category to DNS Protection filtering policies, giving visibility into AI service usage on networks and enabling policy-based control.
   • Introduces Identity Risk Scores in Sophos ITDR — a single ML-derived score combining incident likelihood and compromise impact, updated dynamically as findings and accounts change.
   • Launches Sophos AI Defense Early Access Program for Sophos EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss., and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers on Sophos Fusion, enabling monitoring, control, and security of AI usage across an environment.
   • Expands Sophos ITDR availability to tenants provisioned in Canada, Australia, Japan, India, and Brazil.
   • Enables partners to explicitly select individual add-ons and products when applying bulk license changes to multiple monthly-usage customers simultaneously.

   5 details in Everything

5. changelog Aug 12, 2026 · issue 043
   • Sophos ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. now assigns every identity a Risk Score — a single ML-derived number combining incident likelihood with potential impact — updated dynamically as findings and accounts change.
   • DNS Protection adds a Generative AI category, enabling visibility into AI-service usage on the network and policy-level control over generative AI in DNS filtering rules.
   • Partner portal now supports explicit selection of add-ons and products when applying bulk license changes to multiple monthly-usage customers simultaneously.
6. Latest news seen Aug 11, 2026 · issue 042

   Sophos adds AI Defense EAP, ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. identity risk scores, new ITDR regions, and generative AI DNS filtering category

   • Adds Generative AI as a new category in DNS Protection filtering policies, giving visibility into and control over AI services on your networks.
   • Launches Sophos AI Defense Early Access Program for Sophos EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss., and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers on Sophos Fusion — enables monitoring, control, and securing of AI usage across an environment.
   • Introduces Identity Risk Scores in Sophos ITDR: a single ML-powered score per identity combining incident likelihood with potential impact, updating dynamically as findings and accounts change.
   • Expands Sophos ITDR availability to customers with tenants provisioned in Canada, Australia, Japan, India, or Brazil.
   • Improves bulk license management for partners: monthly-usage customer license changes now support explicit selection of add-ons and products when applied in bulk.

   5 details in Everything

7. August 10, 2026 Aug 10, 2026 · issue 061

   Sophos adds AI Defense EAP, ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. Identity Risk Scores, new ITDR regions, and a Generative AI DNS filtering category.

   • New Generative AI category in DNS Protection filtering policies gives visibility into and control over AI service usage on your networks.
   • Sophos AI Defense (Early Access Program) lets EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss., and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers on Sophos Fusion monitor, control, and secure AI usage across their environment.
   • Sophos ITDR now surfaces a Risk Score per identity, combining breach likelihood with potential impact, powered by a patent-pending ML model that updates as findings and accounts change.
   • Sophos ITDR expands regional availability to Canada, Australia, Japan, India, and Brazil.
   • Partner portal bulk license workflow now lets administrators explicitly select add-ons and products when applying changes to multiple monthly-usage customers simultaneously.

   5 details in Everything

8. updated seen Jul 20, 2026 · issue 020

   Sophos Central adds Network Map, Live Discover for AP6, DNS Protection APIs, Protected Browser extension, and a wave of new alerts and email capabilities.

   └──▷ HOW TO FIND IT
   View the Network Map to understand firewall-to-switch-to-AP6 topology and spot unexpected device relationships at a glance.
   📍In Sophos Central, go to My Products › Network › Network Map.
   • New Network Map provides a visual topology of all Sophos firewalls, switches, and AP6 access points with search and relationship views.
   • Live Discover queries now support AP6 Series access points, enabling on-demand SQL queries against wireless data in the Sophos data lake.
   • New Protected Browser extension lets admins apply security policies and monitor user activity in Chrome and Edge without requiring migration to the full Protected Browser.
   • Web control adds filtering for Generative AI sites, more granular per-site controls, and simplified policy management.
   • New alerts for Account Health Check (AHC) issues now surface unaddressed AHC findings directly in the alerts feed.

   +29 more show less

   • Protected Browser gains a categorized app picker for Generative AI policy creation and new reporting on file uploads and downloads.
   • DNS Protection endpoint and DNS filtering policies are now managed on a single page for Workspace Protection customers.
   • Administrators will soon be required to register at least two MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. methods; a grace period allows registration of a second method at sign-in.
   • New alert fires when API credentials (including AD Sync) are 30, 7, or 1 day from expiration.
   • New alert fires when a Super Admin or Admin role is assigned or removed.
   • Public RESTful APIs for DNS Protection core configuration are now generally available.
   • New Security Services Retainer provides flexible access to Advisory and Professional services plus guaranteed emergency incident response.
   • Global Settings replaces General Settings with use-case-driven categories, search, filters, and a left-panel index.
   • New Sophos Email Plus license tier extends Message History and Quarantine retention to 90 days, adds Message Replay, Contact Trace and Recall, and bundles DMARC Manager.
   • M365-quarantined emails can now be viewed and managed directly within Sophos Central without switching to the M365 portal.
   • Email: Newly Registered Domain (NRDNRDNewly Registered Domain — a domain name created within a recent window (often 30–90 days); cyber tools flag these because attackers frequently register fresh domains to evade reputation-based blocklists.) Protection detects and acts on emails from recently registered domains before delivery.
   • Sophos Email TLS report now includes MFR-mode emails, providing full visibility into TLS encryption across all processed mail.
   • Workspace Protection is generally available, bundling Sophos Protected Browser, DNS Protection, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections., and Email Monitoring System.
   • Device tagging is generally available with tag-based filtering, search-box tag queries, configurable tag column, install-time tagging, and tag suggestions.
   • Partner Super Admins can now reset MFA for users and admins in managed customer tenants.
   • PSA tickets for Autotask and ConnectWise are now enriched with Integrated MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Tool data.
   • AI Assistant adds access to Self-managed and Sophos-managed cases, pinned content, structured feedback tags, and the ability to save and reuse custom prompts.
   • Unauthorized File Protection is a new capability that prevents malicious executables from running on Windows servers.
   • AP6 Series MR8 adds WPA2/WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. Enterprise Authentication, adjustable MAC filtering, and increases the maximum MAC list size to 4096 addresses per SSID.
   • Managed Risk now includes authenticated internal vulnerability scanning for deeper visibility beyond unauthenticated scans.
   • Sophos Switch management gains STPSTPSpanning Tree Protocol, an IEEE standard (802.1D) that prevents Layer 2 network loops by electing a root bridge and blocking redundant switch paths, keeping Ethernet networks stable under failure conditions. (Spanning Tree Protocol) configuration in Sophos Central.
   • Email TLS report shows which TLS version was applied per message and reasons for non-delivery due to Secure Message Policy TLS requirements.
   • AI Search for natural-language queries against security data is generally available for all Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers, now including endpoint telemetry.
   • AI Case Summary and AI Command Line analysis are generally available for accelerating investigations.
   • Sophos DMARC Manager add-on provides DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. (with flattening), and DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. management and reporting, plus BIMI, MTA-STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., and TLS-RPT.
   • Integration health alerts now fire in Sophos Central and via email when a third-party MDR/XDR data ingestion integration is unhealthy or offline.
   • Central Switch Stacking provides a management overlay to simplify administration of stacked Sophos switches.
   • Usage Insights for AP6 Series access points is now available in Sophos Central Wireless.
   • Sophos Advisory Services adds proactive security testing and independent cyber-defense assessments.

   34 details in Everything

9. July 20, 2026 Jul 20, 2026 · issue 048

   Sophos Central adds Network Map topology visualization, AP6 Live Discover queries, and a Protected Browser extension for Chrome and Edge.

   • New Network Map provides a visual representation of Sophos network topology, showing relationships and connections between all Sophos firewalls, switches, and AP6 access points in a Central account, with search capabilities.
   • Live Discover queries now support AP6 Series access points, enabling on-demand querying of wireless data stored in the Sophos data lake.
   • New Workspace Protection: Protected Browser extension lets administrators apply security policies and monitor user activity in Chrome and Edge without requiring migration to the full Sophos Protected Browser.

   3 details in Everything

10. July 20, 2026 Jul 20, 2026 · issue 042

    Sophos Central adds Network Map visualization, Live Discover queries for AP6 access points, and a Protected Browser extension for Chrome and Edge.

    • New Network Map provides a visual topology of all Sophos firewalls, switches, and AP6 access points in a Sophos Central account, with device relationship views and search capabilities.
    • Live Discover queries now support AP6 Series access points, enabling on-demand querying of wireless data stored in the Sophos data lake.
    • New Protected Browser extension lets administrators apply security policies and monitor user activity in Chrome and Edge without migrating users to the full Sophos Protected Browser.

    3 details in Everything

11. updated seen Jul 13, 2026 · issue 014

    Sophos Central adds DNS Protection APIs, Gen-AI web filtering, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enforcement, new email tiers, and expanded MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools./XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. capabilities.

    └──▷ TRY IT
    Rotate API credentials before they expire — use the new expiration alerts as your trigger to call the DNS Protection API and refresh keys.
    copy

    $ curl -X GET 'https://api.central.sophos.com/dns-protection/v1/policies' \
      -H 'Authorization: Bearer <access_token>' \
      -H 'X-Tenant-ID: <tenant_id>'

    Enable Newly Registered Domain protection in Sophos Email to block phishing attempts from freshly created domains before they reach users.
    📍In Sophos Central, go to My Products › Sophos Email › Policies, open or create an Inbound policy, and enable the Newly Registered Domain (NRD) Protection option under threat detection settings.
    Apply a Generative AI category block in Protected Browser to prevent data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. via consumer AI tools.
    📍In Sophos Central, go to My Products › Workspace Protection › Protected Browser › Policies, open your policy, navigate to App Controls, use the new categorized app picker to select the Generative AI category, and set the action to Block.
    • Adds Web Control filtering for Generative AI sites with more granular per-site control and simplified policy management.
    • Enables alerts for Account Health Check (AHC) issues, gradually rolling out to surface unaddressed configuration risks.
    • Adds categorized Gen-AI app picker in Protected Browser policy creation, plus reporting on file uploads and downloads for risky data flow visibility.
    • Consolidates DNS Protection Endpoint and DNS filtering policies onto a single management page for Workspace Protection customers.
    • Requires administrators to register at least two MFA methods for sign-in to reduce lockout risk.

    +24 more show less

    • New alert: API credential expiration warnings at 30 days, 7 days, and 1 day before expiry (including AD Sync credentials).
    • New alert: Super Admin or Admin role assignment and removal events for rapid detection of unexpected privilege changes.
    • Introduces public RESTful APIs for managing core DNS Protection configuration.
    • Adds Security Services Retainer offering flexible access to Advisory and Professional services plus guaranteed emergency incident response.
    • Redesigns Global Settings in Sophos Central with use-case-driven categories, search, filters, and a left-panel index.
    • Introduces Sophos Email Plus tier with 90-day Message History and Quarantine retention, Message Replay, Contact Trace and Recall, and bundled DMARC Manager.
    • Enables viewing and managing M365-quarantined emails directly within Sophos Central.
    • Adds Newly Registered Domain (NRDNRDNewly Registered Domain — a domain name created within a recent window (often 30–90 days); cyber tools flag these because attackers frequently register fresh domains to evade reputation-based blocklists.) Protection in Sophos Email to detect and block phishing and spam from recently registered domains.
    • Includes MFR-mode emails in the Sophos Email TLS report for complete encryption visibility across all processed mail.
    • Launches Workspace Protection (Sophos Protected Browser, DNS Protection, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections., Email Monitoring System) as a generally available product suite.
    • Promotes Device Tagging to GA, adding tag-based device filtering, install-time tagging, and tag auto-suggest.
    • Enables Partner Super Admins to reset MFA for users and admins in managed customer tenants.
    • Enriches Sophos PSA Tickets with Integrated MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Tool Data for Autotask and ConnectWise PSA.
    • Expands AI Assistant with access to Self-managed and Sophos-managed cases, pinned content, structured feedback tags, and saved/reusable custom prompts.
    • Introduces Unauthorized File Protection to prevent malicious executables from running on Windows servers.
    • Adds authenticated internal vulnerability scanning to Sophos Managed Risk for deeper vulnerability visibility.
    • Delivers Usage Insights for AP6 Series access points in Sophos Central Wireless.
    • Adds STPSTPSpanning Tree Protocol, an IEEE standard (802.1D) that prevents Layer 2 network loops by electing a root bridge and blocking redundant switch paths, keeping Ethernet networks stable under failure conditions. (Spanning Tree Protocol) management for Sophos Switches in Sophos Central.
    • Makes AI Search (natural-language security data queries) generally available for all Sophos XDR and MDR customers, now including endpoint telemetry.
    • Promotes AI Case Summary and AI Command Line Analysis to general availability.
    • Introduces DMARC Manager as an add-on with DMARC/SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders./DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. management, SPF flattening, BIMI, MTA-STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., and TLS-RPT.
    • Generates integration health alerts and admin email notifications when MDR/XDR data ingestion integrations are unhealthy or offline.
    • Introduces Central Switch Stacking management overlay to simplify administration of stacked Sophos switches.
    • Adds Internal Attack Surface Management (IASM) to Managed Risk, powered by Tenable Nessus, at no additional cost.

    29 details in Everything

12. July 1, 2026 Jul 1, 2026 · release notes

    Sophos Central adds GenAI web filtering, Protected Browser file transfer reporting, and streamlined partner customer creation.

    └──▷ HOW TO FIND IT
    Block GenAI sites across your organization via UI navigation
    📍In the Console, go to Web Control › Policies, edit a policy, and enable Filter Generative AI sites.
    Monitor risky file flows in Protected Browser using the new reporting view
    📍In the Console, go to Protected Browser › Reports and view File Uploads/Downloads.
    • Adds filtering of Generative AI sites in Web control policies
    • Adds categorized app picker for controlling Generative AI usage in Protected Browser
    • Adds file upload and download reporting in Protected Browser
    • Enables Endpoint DNS policy management on the same page as DNS filtering policies for Workspace Protection customers

    4 details in Everything

13. June 8, 2026 Jun 8, 2026 · release notes

    Sophos Central adds DNS Protection APIs, credential expiration alerts, and admin assignment alerts.

    • Adds new alert for API credential expiration (30 days, 7 days, and 1 day)
    • Adds new alert for Super Admin or Admin assignments

    2 details in Everything

14. May 18, 2026 May 18, 2026 · release notes

    Sophos Central adds Security Services Retainer for advisory and emergency response access

    └──▷ HOW TO FIND IT
    Enable proactive security efforts and guaranteed incident response for your organization.
    📍In the console, go to Services › Security Services Retainer and select Purchase or Manage.
15. April 27, 2026 Apr 27, 2026 · release notes

    Sophos Central adds Global Settings redesign, self-healing alerts, M365 quarantine integration, and NRDNRDNewly Registered Domain — a domain name created within a recent window (often 30–90 days); cyber tools flag these because attackers frequently register fresh domains to evade reputation-based blocklists. email protection.

    • Global Settings replaces General Settings with use-case-driven categories and search
    • View and manage emails quarantined by M365 directly from Sophos Central
    • Newly Registered Domain (NRD) Protection detects and acts on emails from recently registered domains

    3 details in Everything

16. April 7, 2026 Apr 7, 2026 · release notes

    Sophos Email TLS report now covers MFR-mode emails for full encryption visibility across all processed mail.

17. March 16, 2026 Mar 16, 2026 · release notes

    Workspace Protection GA, device tagging GA, Partner MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. reset, and PSA ticket enrichment

    └──▷ HOW TO FIND IT
    Start a trial for Workspace Protection components via the console.
    📍Navigate to My Products › Free Trials and select Workspace Protection
    • Adds steps for Workspace Protection (Protected Browser, DNS Protection, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections., Email Monitoring) to the Free Trials menu
    • Adds device tagging capabilities including tag filtering in search/filters and tag suggestions during install or list view
    • Adds Partner Super Admin ability to reset MFA for users/admins in managed customer tenants
    • Adds Integrated MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Tool Data enrichment to Sophos PSA Tickets for Autotask and ConnectWise

    4 details in Everything

18. February 23, 2026 Feb 23, 2026 · release notes

    Sophos Central adds unauthorized file protection for Windows servers and AI Assistant prompt management.

    └──▷ HOW TO FIND IT
    Navigate to the AI Assistant settings to enable custom prompt management.
    📍In the console, go to Settings › AI Assistant and enable Save and reuse prompts under Prompt Management.
    • Introduces Unauthorized File Protection to prevent malicious executables from running on Windows servers
    • Adds the ability to save, reuse, and manage custom prompts across chats in the AI Assistant
    • Adds structured tags for feedback in the AI Assistant
    • Adds pinned content support in the AI Assistant
    • Expands access to both Self-managed and Sophos-managed cases in the AI Assistant

    5 details in Everything

19. February 2, 2026 Feb 2, 2026 · release notes

    Device tagging beta adds CLI installation tagging, tags search, and auto-complete suggestions in the devices list

    • Adds device tagging capability during Sophos Endpoint command-line installation (beta)
    • Adds tag search and auto-suggest for existing tag names in the Devices list

    2 details in Everything

20. January 20, 2026 Jan 20, 2026 · release notes

    Sophos Central introduces early access for Sophos Protected Browser as part of the Workspace Protection suite.

21. January 12, 2026 Jan 12, 2026 · release notes

    Sophos AP6 Series MR8 adds WPA2/WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. Enterprise Authentication and raises MAC filter list to 4096 addresses per SSID.

22. December 15, 2025 Dec 15, 2025 · release notes

    Beta device tagging available in Computers and servers list; updated Update Licenses UI

    └──▷ HOW TO FIND IT
    Start the beta device tagging workflow via the UI banner.
    📍In the Computers and servers list, click the device tagging beta banner to enable tagging.
    • Adds beta device tagging capability with a banner on the Computers and servers list
    • New look for monthly licensing updates via Update Licenses assistants

    2 details in Everything

23. November 24, 2025 Nov 24, 2025 · release notes

    Sophos Central Managed Risk adds authenticated scanning; Device List gains user search and last update time column.

    └──▷ HOW TO FIND IT
    Perform authenticated vulnerability scans via Managed Risk to find deeper issues than unauthenticated scans can detect.
    📍In the console, go to Managed Risk and configure a new scan with authenticated mode enabled
    Search the device list for endpoints managed by a specific user and view when they last reported in.
    📍In the console, go to Computers and servers, use the User filter box, and add the Last agent update time column
    • Adds Managed Risk support for authenticated internal vulnerability scanning to uncover deeper visibility into potential vulnerabilities
    • Adds user search capability and an optional 'last agent update time' column to the Computers and servers page in Device List

    2 details in Everything

24. October 13, 2025 Oct 13, 2025 · release notes

    Sophos Central adds Sophos Advisory Services offering proactive security testing.

25. September 15, 2025 Sep 15, 2025 · release notes

    Sophos Central adds Usage Insights for AP6 Series access points; updates custom alert rules with integration health category.

    └──▷ HOW TO FIND IT
    Monitor usage metrics for AP6 wireless access points in the central console.
    📍Navigate to Sophos Central Wireless › AP6 Series › Usage Insights
    Create or edit a custom alert rule to include integration health status.
    📍Go to Settings › Alert Rules, select your rule, and choose Integration health from the alert category dropdown for email/PSA integrations.
26. August 11, 2025 Aug 11, 2025 · release notes

    Sophos Central adds STPSTPSpanning Tree Protocol, an IEEE standard (802.1D) that prevents Layer 2 network loops by electing a root bridge and blocking redundant switch paths, keeping Ethernet networks stable under failure conditions. switch management and TLS encryption visibility reports.

    • Delivers management for Spanning Tree Protocol (STP) features for Sophos switches
    • Provides the TLS report with visibility of message encryption versions and non-delivery reasons

    2 details in Everything

27. Version 2025.32Released on August 9, 2025 Aug 9, 2025 · release notes

    Sophos Central 2025.32 adds STPSTPSpanning Tree Protocol, an IEEE standard (802.1D) that prevents Layer 2 network loops by electing a root bridge and blocking redundant switch paths, keeping Ethernet networks stable under failure conditions. management for Sophos Switches and a new TLS Report for Sophos Email.

    └──▷ HOW TO FIND IT
    Review TLS encryption failures to diagnose why messages were rejected by your Secure Message Policy.
    📍In Sophos Central, go to Email › Reports › TLS Report to see the TLS version applied to each message and the non-delivery reason for messages that failed TLS requirements.
    • Adds STP (Spanning Tree Protocol) management for Sophos Switch hardware via Sophos Central, alongside Maintenance Release 02.1.1837 for all Sophos Switch devices.
    • Adds a TLS Report in Sophos Email that shows which TLS version was applied to each message and the reason for non-delivery when a message failed Secure Message Policy TLS requirements.

    2 details in Everything

28. July 21, 2025 Jul 21, 2025 · release notes

    Sophos Central July 2025 adds AI Search, AI Case Summary, DMARC Manager, integration health alerts, and Switch Stacking

    • AI Search is now available for all Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. and Sophos MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers with endpoint telemetry and detection data query support
    • Sophos AI Case Summary and AI Command Line analysis are generally available to accelerate investigations
    • DMARC Manager add-on provides comprehensive management and reporting of DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. records, including SPF flattening, BIMI, MTA-STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., and TLS-RPT
    • Integration health alerts generate notifications when third-party data ingestion integrations are unhealthy or offline for MDR and XDR customers
    • Central Switch Stacking provides a management overlay to simplify managing Sophos switches in a wired stack

    5 details in Everything

29. Version 2025.29Released on July 19, 2025 Jul 19, 2025 · release notes

    Sophos Central 2025.29 adds DMARC Manager, integration health alerts, Switch Stacking, and GA for AI Case Summary and AI Search.

    • Adds Sophos DMARC Manager add-on for comprehensive management and reporting of DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., and DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. records, including SPF flattening, BIMI, MTA-STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., and TLS-RPT.
    • Generates alerts in Sophos Central and sends email notifications to admins when a data ingestion integration is unhealthy or offline, covering all third-party integrations for MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. and XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. customers.
    • Adds Central Switch Stacking to reduce management complexity when running Sophos switches wired together as a switch stack.
    • Promotes AI Case Summary and AI Command Line Analysis to general availability for faster investigations and clearer insights.
    • Makes AI Search — natural-language querying of security data — generally available to all Sophos XDR and MDR customers, now including endpoint telemetry alongside detection data.

    5 details in Everything

30. July 1, 2025 Jul 1, 2025 · release notes

    Sophos Central July 2025 adds IASM via Tenable Nessus, Emergency IR service, Mesh SSID, EMS, and email security reports.

    • Adds Internal Attack Surface Management (IASM) for internal assets using Tenable Nessus technology to Managed Risk customers
    • Launches Sophos Emergency Incident Response service combining Sophos and Secureworks for active cyberattack assistance
    • Adds support for Multiple Mesh SSIDs on AP6 Series access points in Sophos Central
    • Introduces Sophos Email Monitoring System (EMS) Email Sensor for scanning and verdicts on emails from other providers
    • Adds SophosLabs Analysis Report to review reported false positives/negatives in email security configuration

    +3 more show less

    • Enhances QR code policy with scanning of attachments, configurable exclusion, and separate reporting category
    • Expands BEC protection to external VIPs with Aggressive mode, VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. list import/export, per-type configuration, and account compromise alerts
    • Adds Email rejection report for inbound messages rejected due to non-existent recipient mailboxes

    8 details in Everything

31. Version 2025.26Released on June 28, 2025 Jun 28, 2025 · release notes

    Sophos Managed Risk gains internal attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management via Tenable Nessus; AP6 Series adds multiple mesh SSID support.

    • Adds Internal Attack Surface Management (IASM) to Sophos Managed Risk, extending vulnerability management to internal assets using Tenable Nessus technology, available to all new and existing Managed Risk customers at no additional cost.
    • Adds multiple mesh SSID support for Sophos AP6 Series access points in Sophos Central.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Apply License Key button is removed for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. tenants on the Partner Dashboard; MSP tenants must now update licenses exclusively through the Update Billing conversion flow from MSP to Term.
32. June 9, 2025 Jun 9, 2025 · release notes

    Sophos Central June 9 adds integration health alerts, MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. agent renaming, device details pane, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. enhancements

    └──▷ HOW TO FIND IT
    View detailed information for a specific device without leaving the main list view.
    📍Click on a device entry in the Computers and servers page to open the slide-out details pane
    • Generates an alert and email notification when a data ingestion integration (starting with Microsoft 365 Management Activity) is unhealthy or offline
    • Adds on-premises network detection for ZTNA
    • Supports domain controller as an agent-based resource in ZTNA

    3 details in Everything

33. Version 2025.23Released on June 07, 2025 Jun 7, 2025 · release notes

    Sophos Central 2025.23 adds MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. integration health alerts, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. on-premises network detection, and a device details flyout.

    └──▷ HOW TO FIND IT
    Set up email notifications for MDR integration health alerts so your team is immediately notified when the Microsoft 365 Management Activity integration goes offline.
    📍In Sophos Central, go to Alerts, locate the integration health alert for Microsoft 365 Management Activity, then configure email notification settings based on that alert.
    • Adds MDR integration health alerts in Sophos Central when a data ingestion integration is unhealthy or offline, starting with the Microsoft 365 Management Activity integration, with email notification support.
    • Adds on-premises network detection and domain controller support as an agent-based resource in ZTNA, improving usability and performance.
    • Adds a device details flyout that opens when clicking a device in the Computers and servers page, keeping context on the same page.

    3 details in Everything

34. May 19, 2025 May 19, 2025 · release notes

    Sophos Central adds AI Search for endpoint data and Microsoft 365 Response Actions for MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools.

    └──▷ HOW TO FIND IT
    Query endpoint data in the New AI Features EAP using natural language instead of structured queries
    📍In the console, navigate to the AI Search section and enter natural language questions about endpoint logs.
    Enable MDR analysts to respond directly to incidents in a Microsoft 365 environment
    📍In the console, go to Integrations and enable the M365 Response Actions integration.
    • Enables AI Search for endpoint data in the New AI Features EAP, allowing natural language queries against the Sophos Data Lake
    • Adds M365 Response Actions integration to let MDR analysts contain and neutralize attacks in Microsoft 365 environments

    2 details in Everything

35. Version 2025.20Released on May 17, 2025 May 17, 2025 · release notes

    Sophos Central 2025.20 adds AI Search for endpoint data and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. Microsoft 365 Response Actions.

    • Adds MDR Microsoft 365 Response Actions integration, enabling MDR analysts to contain and neutralize attacks in a customer's M365 environment; included in all MDR licenses at no additional cost.
    • Extends XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. AI Search (New AI Features EAP) to endpoint data in the Sophos Data Lake, allowing analysts to query endpoint telemetry using natural language in addition to detections.

    2 details in Everything

36. April 7, 2025 Apr 7, 2025 · release notes

    Sophos Central ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. agent adds inactivity timeout and connection pooling controls; DNS Protection expands to new regions.

    • ZTNA maintenance release 2.1.2 offers options to modify the agent's tunnel inactivity timeout.
    • ZTNA maintenance release 2.1.2 offers an option to disable connection pooling for agentless resources.
    • DNS Protection can now be managed by tenants in the Australia, Brazil, Canada, India, and Japan data regions.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and Email+PIN legacy authentication methods are retired for Central sign-in.
37. February 10, 2025 Feb 10, 2025 · release notes

    Sophos Central Feb 10 2025 release adds AI Assistant in New AI Features EAP

    • Enrolls eligible customers in the New AI Features EAP to access AI Assistant, a GenAI-powered triage and investigation tool using natural language.
    • Provides the capability for users to interact with the Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. platform via natural language queries to accelerate case triage and investigation workflows.

    2 details in Everything

38. January 15, 2025 Jan 15, 2025 · release notes

    Sophos Central adds GeoDNS for DNS Protection, PDF Account Health reports, ConnectWise/Autotask firewall sync, and ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. mgmt in new regions.

    └──▷ HOW TO FIND IT
    Export your security posture report for sharing with auditors or management.
    📍Navigate to Account Health Check › Export › Select PDF
    Configure monthly sync for firewall licenses in ConnectWise PSA.
    📍Go to Integrations › ConnectWise PSA › Sync Settings › Set frequency to Monthly
    • Adds support for improved GeoDNS responses in DNS Protection to target networks by geographical location
    • Adds AP6 Series MR5 access point support for Guest Network NAT mode and power statistics in Sophos Central
    • Adds loopback detection, DoS, and log settings management for Switch devices from Sophos Central
    • Adds the ability to export a PDF report of the Account Health Check dashboard for external stakeholders
    • Adds Let's Encrypt support for automated gateway certificate management in ZTNA (available mid-January)

    +3 more show less

    • Expands ZTNA management availability on Sophos Central to tenants in Australia, Brazil, Canada, India, and Japan
    • Adds monthly firewall product sync capability to ConnectWise PSA and Autotask usage sync integrations
    • Adds configurable sync frequency for ConnectWise PSA integration to align license quantities with the invoice

    8 details in Everything

39. December 3, 2024 Dec 3, 2024 · release notes

    Sophos Central adds Sophos Mobile API GA, alert filtering for PSA integrations, and SPL on-access scanning

    • Makes the Sophos Mobile API generally available to manage enrolled devices
    • Adds support for multiple alert filtering rules in Partner PSA ticketing integrations
    • Adds on-access anti-malware scanning to the Sophos Protection for Linux (SPL) Agent

    3 details in Everything

40. November 11, 2024 Nov 11, 2024 · release notes

    Sophos Central November 11 release adds Mailbox Management API and replaces device lists.

    • Adds the Mailbox Management API to allow creating, reading, searching, updating, and deleting mailboxes in Sophos Email.
    • Replaces the old devices lists with the new Computers and servers list, offering improved searching, more device details, and better performance.

    2 details in Everything

41. October 2, 2024 Oct 2, 2024 · release notes

    Sophos Central adds AI Search for Detections in EAP, expands Switch management regions, and retires legacy dashboard toggle

    └──▷ HOW TO FIND IT
    Configure BATV for your gateway domains in Sophos Email
    📍In Sophos Central Email, go to Settings › Gateway Domains and configure Bounce Address Tag Validation (BATV).
    • Enables AI Search for Detections in New AI Features EAP to query Sophos Data Lake using natural language
    • Adds switch management availability in Sophos Central for tenants in Australia, Brazil, Canada, India, and Japan
    • Adds Bounce Address Tag Validation (BATV) configuration for gateway domains in Sophos Email to defeat backscatter attacks
    • Updates Partner PSA integration so firewall tickets are associated with the corresponding PSA configuration item

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The toggle to switch between dashboards in the legacy Threat Analysis Center is removed as the legacy dashboard has been retired.
42. August 19, 2024 Aug 19, 2024 · release notes

    NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. 1.7 adds investigation console and product pages; PSA integrations support Sophos Switch/AP6 license syncing

    └──▷ HOW TO FIND IT
    Access the new investigation interface within the Central dashboard after upgrading NDR to version 1.7.
    📍Navigate to the NDR section in Sophos Central UI
    Configure your PSA connector to map Sophos Switch monthly support license data.
    📍In Autotask/ConnectWise integration settings, enable mapping for Sophos Switch licenses
    • Adds an NDR investigation console in Sophos Central with the release of NDR 1.7.
    • Introduces new product pages for tools within Sophos Central as part of the NDR 1.7 update.
    • Expands Autotask and ConnectWise PSA integrations to map and sync monthly support license usage for Sophos Switch and AP6 devices.

    3 details in Everything

43. July 31, 2024 Jul 31, 2024 · release notes

    Sophos Central EAP introduces AI features for analyst efficiency; RMM plugins now support Macs without customer tokens

    └──▷ HOW TO FIND IT
    Navigate the console to join the Early Access Program for new AI capabilities.
    📍In Central, go to Settings › Early Access Programs and enable the New AI Features EAP.
    Deploy agents to Macs via ConnectWise without manual token entry.
    📍Use the latest ConnectWise Automate plugin which handles macOS deployment natively, removing the need for customer tokens.
    • Adds Early Access Program (EAP) for new AI-powered features to test enhanced threat investigation and analyst efficiency.
    • ConnectWise Automate plugin updates allow managing Macs, a capability previously only available in the Kaseya VSA plugin.
    • RMM plugins for ConnectWise Automate and Kaseya VSA no longer require customer tokens or product selection to deploy Sophos agents.

    3 details in Everything

44. July 8, 2024 Jul 8, 2024 · release notes

    Sophos Central adds Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. Security V2 integration, public APIs for Detections/Cases, and a new alerts dashboard.

    └──▷ HOW TO FIND IT
    Locate and open the new default alerts dashboard in the console.
    📍Manage Dashboards › Find Dashboards › All alerts
    • Adds Microsoft Graph Security V2 integration for threat investigation in Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools.
    • Releases two new public APIs for integration with Detections and Cases in Sophos XDR
    • Adds a pre-defined All alerts dashboard accessible via the Find Dashboards feature

    3 details in Everything

45. June 19, 2024 Jun 19, 2024 · release notes

    Sophos Central adds F5/Forcepoint integrations, Autotask PSA ticketing, DNS Protection GA, and new device list columns with CSV export.

    • Adds F5 BIG-IP Application Security Manager and Forcepoint NGFW integrations for Sophos MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools./XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. customers with the Firewall integrations license pack
    • Adds device group and tamper protection columns, tamper protection status filtering, a column selector, and CSV export to the new Computers & Servers list
    • Makes Sophos DNS Protection generally available as a new product for network environments providing monitored cloud DNS resolution
    • Adds Autotask PSA ticketing integration allowing alert tracking as PSA tickets and acknowledgement/closure from either platform
    • Adds auto-assignment of Autotask tickets to customer, priority, and category upon integration setup

    +1 more show less

    • Adds links to Sophos device details pages in ConnectWise PSA and Autotask tickets

    6 details in Everything

46. May 30, 2024 May 30, 2024 · release notes

    Sophos Central adds custom dashboards, enhanced devices list with search, and NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. hardware appliance support

    └──▷ HOW TO FIND IT
    Deploy an NDR sensor on a certified hardware appliance for high-throughput network detection.
    📍N/A (Deployment via console or ISO download, specific steps not named in release notes)
    • Adds flexible, interactive custom dashboards for optimizing user operations
    • Enhances the Computers & Servers list with resizable columns, improved Last active details, and a search bar for device name, IP, and OS fields
    • Enables Sophos NDR sensor deployment on certified hardware appliances supporting up to 40 Gbps and 120K connections per second

    3 details in Everything

47. May 7, 2024 May 7, 2024 · release notes

    Sophos Central adds Sophos Managed Risk service, Linux device isolation, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. expansion, and macOS scheduled updates

    • New Sophos Managed Risk service combines Tenable technology with Sophos MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. threat expertise for proactive vulnerability management.
    • Expanded multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. (MFA) coverage to Self Service Portal, Sophos ID landing page, Sophos Community, Partner Portal, and Sophos Support.
    • Device isolation support now available for Linux devices within Sophos Central.
    • macOS updates can now be scheduled via Update Management policy.

    4 details in Everything

48. April 2, 2024 Apr 2, 2024 · release notes

    Usage sync now requires manual PSA product creation instead of auto-provisioning for Autotask and ConnectWise.

    • Updates Autotask integration to only create PSA products on request rather than automatically when usage sync is enabled
    • Updates ConnectWise integration to only create PSA products on request rather than automatically when usage sync is enabled
    • Improves the product mapping user experience for MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. using usage sync

    3 details in Everything

49. March 4, 2024 Mar 4, 2024 · release notes

    Sophos Central adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. validation for user profile updates and AWS AMI deployment for NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems./log collectors

    • Requires MFA validation before users can view, add, or remove their own MFA settings in Sophos Central
    • Enables deployment of NDR and third-party log collector integrations via a new AWS AMI available on the AWS Marketplace

    2 details in Everything

50. February 21, 2024 Feb 21, 2024 · release notes

    Sophos DNS Protection EAP adds custom report template saving, multi-format export, and scheduled reporting.

    └──▷ HOW TO FIND IT
    Save a custom layout for recurring compliance audits in Sophos DNS Protection.
    📍(Via EAP UI) Navigate to Report Templates › Save As and configure your desired fields.
    Export historical DNS data in a specific format for external analysis via the Sophos DNS Protection EAP.
    📍(Via EAP UI) Select Report › Export and choose from available format options.
    Automate daily DNS health checks by scheduling a report delivery in the Sophos DNS Protection EAP.
    📍(Via EAP UI) Select Report › Schedule and configure frequency and recipients.
    • Adds the ability to save your own report templates in Sophos DNS Protection EAP
    • Enables exporting reports in various formats via the Sophos DNS Protection EAP
    • Allows scheduling of automated reports within the Sophos DNS Protection EAP

    3 details in Everything

51. February 12, 2024 Feb 12, 2024 · release notes

    New QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. blocking policy option, Linux Security Health updates with Runtime Detections, and granular Data Control search fields

    • Adds QUIC protocol blocking as an endpoint/server threat protection policy option
    • Expands Sophos Central Linux Security Health to include Sophos Linux Runtime Detections
    • Enhances Data Control policy with granular search configuration for subject, message body, attachment name, and attachment content

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Access to the legacy Investigations feature is removed at the end of February; use Cases instead
52. January 22, 2024 Jan 22, 2024 · release notes

    Sophos Central introduces new navigation and a notifications center in January 22, 2024 update.

    └──▷ HOW TO FIND IT
    Use the new interface to quickly navigate and check alerts.
    📍Log in to Sophos Central and look for the updated navigation bar and notifications bell icon.
    • New navigation menus and shortcuts with easier access
    • New notifications center added to the interface

    2 details in Everything

53. January 8, 2024 Jan 8, 2024 · release notes

    Sophos Central adds AP6 mesh support, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale./LLDP management, and Autotask product mapping in Jan 8 release.

    • Extends change conflict detection to network ports
    • Enables AP6 Series access points to be configured as a wireless mesh network
    • Adds Product Mapping in Central Partner to sync usage with Autotask

    3 details in Everything

54. December 11, 2023 Dec 11, 2023 · release notes

    Sophos Central adds QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. blocking, Sophos DNS Protection product, Email clawback, and XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Okta integration.

    • Adds a new option in endpoint and server threat protection policies to block browser traffic using the QUIC protocol
    • Introduces Sophos DNS Protection, a new cloud-based DNS resolution service product for network environments
    • Enables manual on-demand clawback of messages from M365 inboxes into Sophos Email post-delivery quarantine
    • Adds Okta as an integrated third-party response action within XDR Cases

    4 details in Everything

55. October 30, 2023 Oct 30, 2023 · release notes

    Sophos Central releases new navigation/notifications UI and expands Switch voice VLAN management capabilities

    └──▷ HOW TO FIND IT
    Access the new notification center and streamlined menus before full rollout.
    📍In the console, go to Settings and enable the Try new Central toggle.
    Configure VLANs with conflict resolution for new Sophos Switch devices.
    📍In the console, go to Network › Switch and open a device's VLAN settings to enable conflict management options.
    • Gains access to a redesigned interface with easier-access menus, shortcuts, and a centralized notifications center via the Try new Central toggle.
    • Enables near-complete management of Sophos Central Switch port and VLAN features, including new conflict management options for VLANs.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Controlled Updates feature is turned off; users must migrate to Update Management policies effective September 30, 2023.
56. October 20, 2023 Oct 20, 2023 · release notes

    October 20, 2023 updates introduce New XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. EAP, improved ConnectWise PSA integration, and TLS details in Sophos Email Message History.

    └──▷ HOW TO FIND IT
    Explore the new Case Management interface as part of the Early Access Program for XDR.
    📍In Central, navigate to the New XDR Features EAP section to try the new Case Management user experience
    View TLS handshake information for a specific message to verify encryption standards.
    📍Open Message History in Sophos Email and check the TLS version details for inbound or outbound messages
    • Adds New XDR Features Early Access Program with new Case Management user experience for XDR EAP customers
    • Improves ConnectWise PSA ticketing integration with more control over ticket closure and additional firewall alert details inside tickets
    • Shows TLS version details in Message History for both inbound and outbound email messages

    3 details in Everything

57. September 19, 2023 Sep 19, 2023 · release notes

    Sophos Central adds notifications center beta, Clawback API for email quarantine, and read-only user quarantine configuration.

    • Introduces a new navigation and notifications center in beta
    • Adds Sophos Email: Clawback API to manually claw back messages from M365 inboxes to post-delivery quarantine
    • Enables configuring user quarantine as read-only via the management console

    3 details in Everything

58. September 5, 2023 Sep 5, 2023 · release notes

    Sophos Central adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. gateway integration for SFOS, Linux runtime detection profiles, account health context, and switch backup management

    • Integrates Sophos ZTNA Gateway with Sophos Firewall (SFOS) to simplify ZTNA deployments in early access.
    • Adds ability to create and configure runtime detection profiles for Linux Workloads, enabling rule toggling and allow/block list management applied via server threat protection policies or distributed with Sophos Linux Sensor.
    • Shows average health score for peer organizations of similar size within the Account Health Check view.
    • Enables scheduling, storing, managing, and restoring Central Switch backups directly from Sophos Central.

    4 details in Everything

59. August 29, 2023 Aug 29, 2023 · release notes

    Sophos Central August 29 release adds S3 malware protection, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. soft failure support, and Detections page UX for XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. EAP.

    └──▷ HOW TO FIND IT
    Access the new visual Detections interface if enrolled in the XDR Early Access Program.
    📍In the console, go to Detections › New Features
    Configure SPF soft failure checking for email authentication.
    📍In Sophos Email settings, enable SPF soft failure check under Sender checks.
    Redirect or copy an email using Data Control rules.
    📍In the rule configuration, select Modify address to set a new delivery address or add CC/BCC recipients.
    • Detections page in the New XDR Features Early Access Program provides a new user experience with visuals for actionable data
    • Cloud Optix now supports Serverless Storage protection for AWS S3 buckets to detect malware in all file types
    • Sophos Email Data Control adds Modify address option to change delivery address or copy via CC/BCC
    • Sophos Email Sender checks adds support for SPF soft failure check and new Domain anomaly option

    4 details in Everything

60. August 17, 2023 Aug 17, 2023 · release notes

    Sophos Central adds Sophos AP6 access point support and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. scanning for Macs in EAP

    └──▷ HOW TO FIND IT
    Deploy and manage new Wi-Fi 6Wi-Fi 6The IEEE 802.11ax wireless networking standard, offering higher throughput, lower latency, and better performance in dense environments than its predecessors, which matters for cyber tools doing wireless capture or injection at scale./6E infrastructure directly in your central console
    📍In the Sophos Central dashboard, navigate to Wireless › Access Points and configure Sophos AP6 devices.
    Inspect encrypted traffic on macOS endpoints to detect threats hidden in HTTPS streams
    📍Join the macOS Endpoint Early Access Program and enable SSL/TLS decryption in your EAP configuration.
    • Adds management of Sophos AP6 Wi-Fi 6/6E access points through Sophos Central
    • Enables SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS decryption to scan HTTPS web pages on Macs via the macOS Endpoint Early Access Program

    2 details in Everything

61. August 8, 2023 Aug 8, 2023 · release notes

    Sophos Central adds Google Directory sync for Email and M365 on-demand clawback; NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. production deployed free in EAP.

    • Adds Google Directory synchronization to Sophos Email for automatic user and group information import
    • Enables one-click message removal from M365 mailboxes via Message History for On-demand clawback capability

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SAV for Linux and Sophos for Virtual Environments reach End of Life (EoL) on July 20, 2023; products are no longer supported.
    • !Windows 8 is no longer supported; customers must upgrade to a supported operating system.
62. July 5, 2023 Jul 5, 2023 · release notes

    Sophos Central adds XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. visual health scores, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. routing, outbound disclaimers, and Quarantine API

    • Adds a numeric Score (0-100) to the Account Health Check UI to visually track remediation progress.
    • Adds SMTP routing capability to Sophos Email, allowing inbound/outbound gateway messages to be rerouted via A-record or FQDN.
    • Adds Outbound Disclaimer settings for plain text and HTML messages in the Email Security Policy.
    • Adds a Quarantine API for performing operations on messages in both Email Security Quarantine and Post Delivery Quarantine.

    4 details in Everything

63. June 5, 2023 Jun 5, 2023 · release notes

    Adaptive Attack Protection auto-enabled; XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Beta dashboard preview

    └──▷ HOW TO FIND IT
    Access the new XDR Beta dashboard to view threat analysis enhancements.
    📍In Sophos Central, go to Threat Analysis Center and look for the Beta dashboard tab.
    • Automatically enables Adaptive Attack Protection for all Sophos Endpoint users to disrupt hands-on-attack actions.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Sophos Anti-Virus for Linux reaches End of Life on July 20, 2023; users must migrate to Sophos Protection for Linux.
    • !Sophos for Virtual Environments (SVE) reaches End of Life on July 20, 2023; users must install Endpoint or Server Protection on Guest VMs.
64. May 22, 2023 May 22, 2023 · release notes

    Sophos Central May 2023 adds quarantined email attachment controls, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Foundations v1.5 policy, S3 malware protection, and legacy OS version management.

    • Adds download, strip, and reattach controls for attachments in quarantined emails
    • Enables submission of quarantined emails to SophosLabs Intelix for scanning
    • Adds new policy for CIS Azure Foundations Benchmark v1.5 with associated security assessment rules
    • Extends Cloud Optix protection to AWS S3 buckets for malware detection in all file types
    • Expands endpoint version control management to older Windows (7, 8, 8.1, 10 32-bit) and Server (2008 R2, 2012, 2012 R2) versions

    5 details in Everything

65. April 24, 2023 Apr 24, 2023 · release notes

    Sophos Central adds Email policy cloning, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. port ranges, and Sophos Switch layer 2 enhancements

    • Enables cloning of any Sophos Email policy, inserting the clone directly above the source in the UI hierarchy
    • Adds support for defining port ranges for agent-based resources within ZTNA configurations

    2 details in Everything

66. March 14th, 2023 Mar 14, 2023 · release notes

    Sophos Central March 14th adds ConnectWise sync, mail header modify, EAP search, and Mac isolation

    └──▷ HOW TO FIND IT
    Sync Sophos Central alerts to ConnectWise PSA automatically without manual ticket creation.
    📍Configure Central Partner settings to enable automatic ticket creation in ConnectWise for resolved alerts.
    Modify email headers as part of a data control rule before delivery.
    📍In Data Control rules, choose the modify headers action to inspect and change message attributes.
    Isolate a compromised Mac from the network immediately.
    📍Select the macOS device in the console and choose Isolate to cut off network access.
    • Adds ConnectWise PSA ticket integration for automatic alert-to-ticket creation and acknowledgement.
    • Enables modification of email message headers via Data Control rules in Sophos Email.
    • Introduces an aggressive anti-spam mode allowing different catch rate levels per sender or user.
    • Adds a new Secure Message policy to manage encryption, decryption, signing, and verification settings.
    • Enables administrators to manually isolate macOS devices from the network.

    +3 more show less

    • Extends improved version control for servers to Windows servers, previously limited to Windows computers.
    • Launches Simplified Search in XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Early Access Program for SQL-free endpoint data lake queries.
    • Adds Snooze and comment capabilities to Account Health Check issues.

    8 details in Everything

67. January 30, 2023 Jan 30, 2023 · release notes

    Sophos Central adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS policy, on-access scanning/quarantine for Linux, and improved endpoint version control.

    • Adds a new CIS AWS Foundation Benchmark v1.5 certified policy to Cloud Optix with security assessment rules for AWS.
    • Enables on-access scanning and quarantine capabilities in the Sophos Protection for Linux (SPL) agent.
    • Improves endpoint version control management for Windows computers.
    • Announces the retirement of SAV for Linux with an End of Life date of July 20, 2023.

    4 details in Everything

68. January 18, 2023 Jan 18, 2023 · release notes

    Sophos Central adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Cloud deployment mode and macOS support for the ZTNA agent.

    • Adds ZTNA: Sophos Cloud deployment mode to use a Sophos-protected data plane in the cloud
    • Extends ZTNA agent support to macOS, enabling access to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. (like SSH) or UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. (like Remote Desktop) private apps

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Retirement of Sophos Anti-Virus for Linux and SVE effective July 20, 2023
69. November 30, 2022 Nov 30, 2022 · release notes

    Sophos Central Nov 2022: MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. third-party integrations and NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. product availability

    • Adds third-party security product integration for alert data ingestion across email, firewall, network, cloud security, and identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
    • Adds Sophos Network Detection and Response (NDR) as a new product capability for MDR customers to monitor north-south and east-west traffic

    2 details in Everything

70. November 7, 2022 Nov 7, 2022 · release notes

    Sophos Central adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections.-as-a-service early access, Mac ZTNA agent EA, ConnectWise Manage sync, and Account Health Check Fix Automatically UI

    • Adds the Fix Automatically option to each part of the Account Health Check dashboard.
    • Starts an early access program for Sophos ZTNA as a service using a cloud-protected data plane.
    • Starts an early access program for a ZTNA agent for Macs supporting TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. private app access.
    • Adds ConnectWise Manage PSA ticketing sync, allowing alerts to be set as tickets which can then be closed or acknowledged.

    4 details in Everything

71. September 6, 2022 Sep 6, 2022 · release notes

    Sophos Central adds XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Sensor early access, on-demand MTR cases, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Hyper-V support, and Jamf Pro macOS deployment simplification.

    └──▷ HOW TO FIND IT
    Request an investigation for a specific threat found in the console.
    📍Initiate on-demand case creation from the Threat Analysis Center interface.
    Deploy ZTNA Gateways on Hyper-V hypervisors for enhanced troubleshooting and support.
    📍Select Hyper-V as the platform option when deploying a new ZTNA Gateway.
    Silently deploy Endpoint Protection for macOS through Jamf Pro without manual intervention.
    📍Configure the simplified deployment profile in Jamf Pro for macOS endpoints.
    • Enables testing of Sophos detection, investigation, and response capabilities with non-Sophos endpoint protection via the new XDR Sensor deployment
    • Adds on-demand case creation for health checks or investigations of detections in the Threat Analysis Center
    • Adds Hyper-V support for ZTNA Gateways
    • Simplifies silent deployment of Endpoint Protection for macOS using Jamf Pro

    4 details in Everything

72. July 25, 2022 Jul 25, 2022 · release notes

    Sophos Central adds Tamper protection filtering/controls and Cloud Native Security bundle; Switch command-line access

    • Devices list now lets you see whether tamper protection is turned on, filter for devices where it's off, and turn it on for selected devices
    • Account Health Check will warn you if tamper protection is off
    • Introducing Sophos Cloud Native Security bundle including Intercept X for Server with XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. and Cloud Optix
    • Sophos Switch command-line access allows sending CLI commands to switches directly from Sophos Central

    4 details in Everything

73. July 5, 2022 Jul 5, 2022 · release notes

    Sophos Central adds dark mode, User Activity Verification EAP, Partner RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for firewall templates, new account regions

    • Adds dark mode support to the Sophos Central sign-in screen and user interface for all Central Admin, Enterprise, and Partner users.
    • Enables User Activity Verification EAP for Sophos Mobile customers to send questions about suspicious activity or approval requests to mobile devices.
    • Introduces role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for firewall settings in Central Partner, allowing admins to restrict customer firewall template access by role.
    • Expands supported account regions to include Australia, Brazil, India, and Japan.

    4 details in Everything

74. June 14, 2022 Jun 14, 2022 · release notes

    Sophos Central adds tamper protection management filters, Linux sensor API, new switch support, and partner account conversion.

    • Adds filtering for devices with Tamper Protection off to the Devices list
    • Enables turning on Tamper Protection for selected devices directly from the Devices list
    • Introduces a new API for deploying Sophos Linux Sensor (Intercept X Advanced for Server)
    • Adds support for managing CS210-24FP and CS210-48FP switches in Sophos Central
    • Allows partners to convert trial accounts to monthly accounts

    5 details in Everything

75. May 3, 2022 May 3, 2022 · release notes

    Sophos Central adds EU region for Cloud Optix and enhances Account Health Check visibility.

    • Adds Account Health Check to highlight scanning exclusions or threat protection policies that reduce protection
    • Extends Cloud Optix availability to the EU data center in Germany

    2 details in Everything

76. April 14, 2022 Apr 14, 2022 · release notes

    Sophos Central April 2022 adds EU Cloud Optix, ConnectWise Manage EAP, and enhanced Account Health Check

    └──▷ HOW TO FIND IT
    Deploy Cloud Optix in the EU region to ensure compliance with local data storage regulations.
    📍Initiate deployment from the Sophos Central interface selecting the Frankfurt, Germany data center location.
    Enroll in the Early Access Program for the ConnectWise Manage ticketing integration.
    📍Contact your Sophos account manager or sales engineer to request enrollment.
    • Cloud Optix is now deployable from the Frankfurt, Germany data center to meet EU data residency requirements.
    • ConnectWise Manage ticketing integration enters Early Access Program (EAP) for Sophos Central Partner users.

    2 details in Everything

77. March 21, 2022 Mar 21, 2022 · release notes

    Sophos Central March 21 2022 release adds S/MIMES/MIMEAn email encryption and signing standard that uses X.509 certificates to authenticate senders and protect message contents; cyber tools use it to verify identity and enforce confidentiality over standard mail protocols. support for Email and granular API credential roles

    └──▷ HOW TO FIND IT
    Enroll a domain in Sophos Email to route mail directly through Microsoft 365 flow rules without changing MX records.
    📍In Sophos Central, navigate to Gateway › Sophos Mailflow, select your domain, and follow the wizard to configure direct integration with Microsoft 365.
    Limit software permissions by assigning specific API roles when generating new credentials for Sophos Central integrations.
    📍When creating an API credential in Sophos Central, select from the new role list: Super Admin, Management, Forensics, Read-only, or Active Directory.
    • Adds direct integration with Microsoft 365 mail flow rules to bypass MX record redirection
    • Includes S/MIME email encryption and digital signature capabilities in Sophos Email Advanced
    • Introduces new API roles: Super Admin, Management, Forensics, Read-only, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.

    3 details in Everything

78. February 7, 2022 Feb 7, 2022 · release notes

    Sophos Central February 7 2022 adds configurable Data Lake query windows, XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. investigations UI, M365 log upload, and enhanced ransomware detection.

    • Adds the ability to configure the time range (default 7 days) for one-off and scheduled queries against the Sophos Data Lake in XDR
    • Introduces a new XDR Investigations feature allowing teams to collaborate on incident analysis within the service UI
    • Enables customers with Microsoft 365 to upload Microsoft log data to the Sophos Data Lake for querying
    • Redesigns ransomware detection logic to detect more families and protect larger files in Intercept X

    4 details in Everything

79. January 24, 2022 Jan 24, 2022 · release notes

    Sophos Central introduces Federation EAP for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with Azure AD, ADFS, and Okta, plus an Account Health Check for device security status.

    • Adds early access to Federation (Single Sign-On) for Central Admin and Enterprise users to authenticate via Azure AD, ADFS, and Okta (OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.)
    • Adds Account Health Check capability to identify devices missing security software in the console

    2 details in Everything

80. January 17, 2022 Jan 17, 2022 · release notes

    Sophos Central adds Azure/GCP support for XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Data Lake, Switches hardware entry, Mailflow EAP for M365, and next-gen scanning architecture.

    • XDR Data Lake now supports Microsoft Azure and Google Cloud Platform for cloud workload detection and hardening
    • Switches entry added to My Products for network access layer switches
    • Mailflow EAP for Microsoft 365 enables direct inbound and outbound email protection integration
    • Intercept X rollout of next-gen scanning architecture with reduced footprint and smaller updates

    4 details in Everything

81. January 5, 2022 Jan 5, 2022 · release notes

    Sophos Central introduces a new sign-in experience starting in January.

    • Launches a new sign-in workflow that begins with an email ID and branches based on Super Admin configuration

    1 detail in Everything

82. December 6, 2021 Dec 6, 2021 · release notes

    Sophos Central updates include ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. EAP with device health and Okta support, new UI sign-in flow, enterprise MTR preferences, and Cloud Optix behavioral anomalies.

    └──▷ HOW TO FIND IT
    Configure MTR preferences for all sub-estates from the Enterprise admin level.
    📍Navigate to Sophos Central Enterprise › Settings › MTR Preferences to set defaults for sub-estates.
    • Adds ZTNA policies based on device health reported by Intercept X, AWS gateways, clustering, and Okta integration to the early access program
    • Introduces a new sign-in experience that follows different workflows based on Super Admin configuration for the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
    • Enables Enterprise Admins to set MTR preferences for all sub-estates from the Sophos Central Enterprise level

    3 details in Everything

83. November 15, 2021 Nov 15, 2021 · release notes

    Sophos Central introduces the Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Detections dashboard for prioritized security monitoring.

    └──▷ HOW TO FIND IT
    Access the prioritized list of suspicious activity in the console.
    📍In the console, navigate to the Detections dashboard
    • Makes the Sophos XDR Detections dashboard available for all XDR customers

    1 detail in Everything

84. October 4, 2021 Oct 4, 2021 · release notes

    Sophos Central adds AD Sync for devices/groups, Cloud Optix XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. data, free wireless license, and endpoint deployment API.

    • Adds AD Sync support for synchronizing devices and device groups
    • Adds Cloud Optix integration to Sophos XDR for AWS environment data
    • Removes license requirement for Sophos Wireless, now available to all accounts at no extra cost
    • Adds endpoint deployment API for automated agent deployment across multiple accounts

    4 details in Everything

85. August 23, 2021 Aug 23, 2021 · release notes

    Cloud Optix adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Foundations Benchmark v1.3.0 policy; SVE installer gains MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support

    • Adds a new Cloud Optix policy template for the Microsoft Azure Foundations Benchmark v1.3.0 (CIS certified)
    • Updates Sophos for Virtual Environments installation to work with Sophos Central accounts that have MFA enabled

    2 details in Everything

86. August 2, 2021 Aug 2, 2021 · release notes

    Sophos Central adds Linux antivirus plugin, auto agent removal in Cloud Optix, and enhanced Smart Banners.

    • Adds Sophos Protection for Linux antivirus plugin to run on-demand scans of Linux servers
    • Enables automatic removal of Sophos server agents via Cloud Optix when AWS or Azure VMs are terminated
    • Enhances Smart Banners to allow email recipients to report spam and unwanted bulk email to SophosLabs

    3 details in Everything

87. July 12, 2021 Jul 12, 2021 · release notes

    Sophos Central July 2021: Merged EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss., enhanced email history search/filters, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support

    • Upgraded all Sophos EDR customers to XDR and increased the standard storage period for historical data in the Data Lake from seven days to thirty.
    • Enhanced email history with the ability to search messages by sender, see multiple recipients' details (SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. and Header), filter messages by the reason for quarantine, and view SMTP logs from Postfix on hover.
    • Added support for ARM64 Windows devices to Intercept X Advanced.

    3 details in Everything

88. June 21, 2021 Jun 21, 2021 · release notes

    Endpoint Protection EAP adds HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. decryption; Devices list gets single-column summary and bulk Manage Endpoint Software actions; SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. API supports parent-org auth via creden

    └──▷ HOW TO FIND IT
    Review protection coverage at a glance in the new Devices list view.
    📍Navigate to Devices › View options › enable Protection column
    Deploy or remove endpoint protection packages for multiple devices in one action.
    📍In the Devices list, select target devices › click Manage Endpoint Software › choose package › Apply
    • Adds HTTPS traffic decryption to the Web Protection feature in the Early Access Program (EAP)
    • Adds a single-column summary of protection status to the Devices list view
    • Adds bulk package assignment via Manage Endpoint Software from the Devices list for selected devices
    • Adds parent-organization API credential support for authenticating to the SIEM API across managed tenants

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !API tokens no longer authorize access across all managed tenants; tokens only authorize for the tenant organization where they were created
89. June 7, 2021 Jun 7, 2021 · release notes

    Sophos Mobile adds iOS User Enrollment mode; Intercept X Advanced for Server moves AWS/Azure connections to Cloud Optix

    • Adds support for the iOS User Enrollment mode in Sophos Mobile to improve BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. environments.
    • Replaces direct AWS and Azure connections in Intercept X Advanced for Server with integration into Cloud Optix for cloud environment insight.

    2 details in Everything

90. March 29, 2021 Mar 29, 2021 · release notes

    Sophos Central introduces Zero Trust Network Access Early Access Program and enhanced email portal encryption for Email Advanced.

    • Sophos Zero Trust Network Access (ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections.) Early Access Program (EAP) begins registration
    • Sophos Email Advanced supports an enhanced range of message encryption methods

    2 details in Everything

91. March 8, 2021 Mar 8, 2021 · release notes

    March 8, 2021 release adds Linux AV plugin early access, Live Discover pivoting, and Live Response session audit logs to Sophos Central.

    └──▷ HOW TO FIND IT
    Join the EAP to test on-demand AV scans on Linux servers via the new plugin interface.
    📍Steps: In Sophos Central, navigate to Early Access Programs, locate Server Protection for Linux, and join the program to access the AV plugin.
    Use the new Live Discover pivot feature to jump to a detailed query from an existing search result.
    📍Steps: Open a Live Discover query, locate the pivot option in the results view, and click to start the new query without manual entry.
    Download and review audit logs for a specific Live Response session to see all executed commands.
    📍Steps: Go to the Live Response section in Sophos Central, select a past session, and use the download option for its audit log.
    • Early access program for Server Protection for Linux AV plugin to run on-demand scans
    • Live Discover pivot capability to start a new query from an existing result set without manual copy-paste
    • Audit logs for Live Response sessions that admins can download to review commands executed

    3 details in Everything

92. February 23, 2021 Feb 23, 2021 · release notes

    Sophos Central adds EAP for XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss./EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. with online/offline device querying, Azure AD sync filters, and endpoint isolation APIs.

    └──▷ HOW TO FIND IT
    Filter synchronized Azure AD groups to exclude test accounts
    📍In the Sophos Central console, go to Settings › Directory Sync › Azure AD and configure the new filter rules for users and groups.
    • Enables querying both online and offline devices via the Intercept X EAP
    • Adds filtering options for users and groups synchronized from Azure AD
    • Allows changing the directory service synchronization source while preserving existing matches
    • Provides O365 API access for Sophos Email Search and Destroy to identify and remove malicious emails automatically
    • Adds endpoint isolation APIs to isolate computers singly or in bulk, manage exclusion, and query by isolation status

    5 details in Everything

93. January 25, 2021 Jan 25, 2021 · release notes

    Sophos Central adds tamper protection password export (CSV/PDF) and Search and Destroy EAP for email.

    └──▷ HOW TO FIND IT
    Export tamper protection credentials to CSV for incident response readiness.
    📍Navigate to Endpoint › Tamper Protection settings and select Export passwords › CSV
    • Adds the ability to export tamper protection passwords in CSV and PDF formats
    • Introduces Sophos Email Advanced Search and Destroy Early Access Program using O365 APIs
    • Enables identification and correction of overprivileged AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. users, groups and roles in Cloud Optix

    3 details in Everything

94. December 1, 2020 Dec 1, 2020 · release notes

    Sophos Central Dec 2020 adds multi-firewall reporting, AD sync API creds, connection tracking, XG FW updates, and global settings APIs.

    └──▷ TRY IT
    Enumerate all admin roles in your tenant to audit access control.
    copy

    $ GET https://api.sophos.com/api/v1/roles

    Configure API credentials for AD Sync instead of legacy username/password.
    📍# Set AD Sync client version >= 3.3.4 # Update config with new API credentials in the console
    Enable network connection tracking for Windows endpoints to improve detection.
    📍In Threat Protection Policies, enable Track network connections for Windows targets.
    • Adds Multi-firewall reporting to Central Firewall Reporting Advanced, allowing multiple firewalls in a single report via Report Hub and Report Generator.
    • Requires AD Sync clients version 3.3.4+ to use API credentials for synchronization starting February 2021, replacing username/password auth.
    • Adds Track network connections option to threat protection policies for Windows endpoints and servers to improve detection capabilities.
    • Enables scheduled and bulk firmware updates for XG Firewall 18 MR3 or later, including group-based bulk updates.
    • Exposes Roles API to enumerate admin roles and create, update, or delete individual roles; exposes global settings APIs for scanning exclusions, exploit mitigation, and intrusion prevention.

    +16 more show less

    • Adds Cloud Optix integration to monitor AWS and Azure spend, compare services, and receive optimization recommendations in a single console.
    • Extends Self Service Portal help to all languages supported by Sophos Central.
    • Allows scheduling custom reports in Central Firewall Reporting Advanced and exporting them directly to the inbox.
    • Introduces Flexible Enterprise Master Licenses to allocate specific product licenses to sub-estates or pool them for shared use.
    • Adds Live Discover and Live Response support for macOS in Intercept X Advanced with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device..
    • Adds IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. to the Early Access Program for New Server Protection and EDR Features.
    • Allows saving custom report templates in Central Firewall Reporting Advanced.
    • Extends session timeout for Sophos Central Admin, Partner, and Enterprise to 3 hours inactive / 24 hours enforced by default, up to 8 extensions per day.
    • Adds Cloud Optix Quick-start setup for AWS to enable core CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. features with minimal clicks.
    • Combines Intercept X Advanced for Server with EDR and Cloud Optix to extend protection to critical cloud services.
    • Adds role management for Live Response, new Live Discover queries, and Linux support for Live Response in the server Early Access Program.
    • Updates Summary and Devices tabs on user details pages with consistent layout and mobile-specific actions.
    • Rolls out full EDR functionality to Intercept X Advanced with EDR and Intercept X Advanced for Server with EDR customers.
    • Adds Synchronized Security enhancements for Sophos Wireless: separate activation from Mobile, SSID restriction to managed devices, allowed domains for red Security Heartbeat, and unmanaged device identity display.
    • Adds advanced search in Cloud Optix for inventory data including hosts, containers, networks, storage services, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, and serverless functions.
    • Releases Tenant Directory Management API (user/group management) and Global Settings API phase 1 (allowed applications, blocked items, website management).

    21 details in Everything

95. November 23, 2020 Nov 23, 2020 · release notes

    Multi-firewall reporting allows including multiple firewalls in a single report via Report Hub.

    └──▷ HOW TO FIND IT
    Generate a consolidated report for multiple firewalls instead of individual device reports.
    📍In the Report Hub, select New Report, choose Central Firewall Reporting Advanced, and add multiple firewall devices to the report scope.
    • Adds multi-device reporting capability to Central Firewall Reporting Advanced

    1 detail in Everything

96. November 2, 2020 Nov 2, 2020 · release notes

    Sophos Central introduces AD Sync API credentials, network connection tracking for Windows, and bulk firewall updates.

    • Adds support for API credentials in AD Sync instead of username/password
    • Adds Track network connections option to threat protection policies for Windows endpoints
    • Enables scheduled firmware updates for XG Firewall 18 MR3 or later
    • Adds bulk firmware update capability for grouped XG Firewalls

    4 details in Everything

97. September 21, 2020 Sep 21, 2020 · release notes

    New report scheduling/exports in Central Firewall Reporting Advanced and macOS Live Discover/Response in Intercept X

    • Adds Central Firewall Reporting Advanced with manual generation, viewing, scheduling, and export capabilities to inbox or Sophos Central for favorite and custom reports
    • Enables allocation of specific license counts per sub-estate for selected products in Flexible Enterprise Master Licenses, including zero-license allocation to prevent product use
    • Adds macOS support for Live Discover and Live Response features in Intercept X Advanced with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.

    3 details in Everything

98. August 17, 2020 Aug 17, 2020 · release notes

    Sophos Central extends session timeout to 24h; introduces Cloud Optix Quick-start setup for AWS CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps..

    • Extends default session inactivity timeout to 3 hours and max session duration to 24 hours before enforced sign-out in Sophos Central Admin, Partner, and Enterprise

    1 detail in Everything

99. July 20, 2020 Jul 20, 2020 · release notes

    EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. updates add role management for Live Response, new Live Discover queries, and Linux server support.

    • Adds role management capabilities to the Live Response feature within Sophos Intercept X Advanced with EDR.
    • Introduces new queries available in the Live Discover engine.
    • Enables Live Response functionality on Linux servers as part of the Early Access Program.

    3 details in Everything

100. June 29, 2020 Jun 29, 2020 · release notes

     Sophos Central adds EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. features, Sophos Wireless SSID restriction, Cloud Optix search, and Tenant Directory APIs

     • Activates Synchronized Security for Endpoint independently from Mobile UEM
     • Restricts an SSID to Sophos managed devices only
     • Creates a list of allowed domains for red Security Heartbeat status in Sophos Wireless
     • Shows user identity for unmanaged devices on the Devices page
     • Searches inventory data for hosts, containers, networks, storage services, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, and serverless functions in Cloud Optix

     +2 more show less

     • Manages users and groups via Tenant Directory Management API
     • Manages allowed applications, blocked items, and websites via Global Settings API (phase 1)

     7 details in Everything

101. June 8, 2020 Jun 8, 2020 · release notes

     Sophos Central adds Tenant Directory and Global Settings APIs for user/group/setting management

     • Adds Tenant Directory Management API to manage users and groups
     • Adds Global Settings API (phase 1) covering allowed applications, blocked items, and website management

     2 details in Everything

102. May 4, 2020 May 4, 2020 · release notes

     Sophos Central May 2020 adds Global Settings sample submission toggle and extends Live Response/Discover Linux support.

     └──▷ HOW TO FIND IT
     Enable automatic malware sample submission to threat intelligence via the admin console.
     📍In Global Settings, enable the Automatically submit sample files to SophosLabs option
     • Adds an option in Global Settings to automatically submit sample files to SophosLabs

     1 detail in Everything

103. April 14, 2020 Apr 14, 2020 · release notes

     Sophos Central adds Live Discover EAP with customizable SQL queries, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. certification for Cloud Optix, and extended container support.

     • Adds Live Discover Early Access Program for endpoint and server customers to run customizable pre-built SQL queries
     • Extends Sophos XG Firewall free trials to 90 days including Sophos Connect IPSec VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. client

     2 details in Everything

104. March 23, 2020 Mar 23, 2020 · release notes

     Sophos Central introduces a new sign-in screen UI and extends XG Firewall trial to 90 days.

     • Displays a new look and feel for the Sophos Central sign-in screen while preserving existing authentication and URL access
     • Extends Sophos XG Firewall free trials from the previous duration to 90 days, including the Sophos Connect IPSec VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. client

     2 details in Everything

105. March 16, 2020 Mar 16, 2020 · release notes

     Sophos Central adds AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. integration for adding accounts to Cloud Optix.

     • Adds AWS CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. as a new method to provision individual or multiple AWS accounts into Sophos Cloud Optix
     • Enables automatic AMSI protection deployment for endpoint users to detect and block obfuscated scripts

     2 details in Everything

106. February 24, 2020 Feb 24, 2020 · release notes

     Sophos Central adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. visualization, spend monitoring, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. container security, Phish Threat customization, XG Firewall groups and reporting, and Email DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. signing.

     • IAM visualization provides a breakthrough in public cloud IAM identity mapping
     • spend monitoring offers security-focused cloud cost visibility
     • extended container security with Amazon EKS adds support for Amazon Elastic Kubernetes Service
     • Sophos XG Firewall 18: group policies lets you add firewalls to groups and manage policy from Sophos Central
     • tasks queue monitors application of policies across firewall groups

     +2 more show less

     • Sophos XG Firewall 18: reporting provides custom network activity reports included for free in version 18
     • Email DKIM signing enables signing outbound emails with DKIM via domain settings

     7 details in Everything

107. February 3, 2020 Feb 3, 2020 · release notes

     Sophos Intercept X Enhanced Protection EAP now available for servers

     └──▷ HOW TO FIND IT
     Access the server EAP build to test enhanced protection against script, memory-based, heap spray, and CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. exploits.
     📍In Central Admin: go to Settings › Updates and select Sophos Intercept X Enhanced Protection (EAP) for servers.
108. January 13, 2020 Jan 13, 2020 · release notes

     Sophos Central adds Email impersonation protection, Chromebook security in Mobile 9.5, and granular custom roles.

     • Adds Sophos Email impersonation protection to detect business email compromise and targeted phishing
     • Introduces Chromebook security capabilities via Sophos Mobile 9.5

     2 details in Everything

109. December 9, 2019 Dec 9, 2019 · release notes

     Sophos Central EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. adds live Threat Indicators, S3 upload for forensic snapshots; Enterprise APIs launch.

     └──▷ HOW TO FIND IT
     Configure Sophos Wireless captive portal to use custom branding and Google social login.
     📍In the Sophos Central console, navigate to Wireless › Hotspot Settings › Captive Portal. Upload your logo, select brand colors, and enable Google under Social Login providers.
     View the new Threat Indicators list to focus on high-suspicion network items.
     📍In Sophos EDR console, go to Threat Indicators in the left-hand navigation pane.
     • Adds Threat Indicators list view to Sophos EDR console for prioritizing suspicious network items
     • Enables automated upload of forensic snapshots to Amazon S3 buckets via new configuration option
     • Launches Sophos Central Enterprise APIs for programmatic management of tenants, endpoints, and alerts
     • Adds captive portal customization (logo, brand colors) and social login selection (Facebook, Google) for Sophos Wireless hotspots

     4 details in Everything

110. November 11, 2019 Nov 11, 2019 · release notes

     Sophos Central adds early access to XG Firewall v18 management and reporting

     └──▷ HOW TO FIND IT
     Access the new v18 reporting and grouping capabilities via the Central UI.
     📍Navigate to Sophos Central › Devices › Firewalls and select your XG Firewall v18 device.
     • Enables running firewall reports for XG Firewall v18 directly in Sophos Central
     • Allows grouping v18 firewalls together for unified management

     2 details in Everything

111. October 22, 2019 Oct 22, 2019 · release notes

     Sophos Central introduces Intercept X Enhanced Protection EAP and Cloud Optix posture enhancements for AWS, Azure, GCP, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup..

     • Enables Early Access Program (EAP) for New Endpoint Protection Features including AMSI and IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. protection against script, memory-based attacks, and malicious traffic patterns.
     • Updates Cloud Optix service with a single security posture view across AWS, Azure, GCP, and Infrastructure as Code environments.

     2 details in Everything

112. September 9, 2019 Sep 9, 2019 · release notes

     Sophos Central adds BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. passcode rotation and user file protection via Outlook add-in

     • Enables users to change their own BitLocker passcode
     • Allows users to protect files with a password before sharing via on-demand action or the Outlook add-in

     2 details in Everything

113. August 19, 2019 Aug 19, 2019 · release notes

     Sophos Central adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Email in EAP and custom admin roles for Partner users

     └──▷ HOW TO FIND IT
     Enable custom role creation for partner admins to limit scope to specific products.
     📍In the Partner console, navigate to Admin › Roles and create a custom admin role with Edit policies unchecked.
     • Sophos Email Data Loss Prevention enters early access to protect sensitive information in emails and attachments.
     • Custom admin roles can be created in Sophos Central Partner to restrict access to specific products without policy edit rights.

     2 details in Everything

114. July 29, 2019 Jul 29, 2019 · release notes

     Sophos Central adds custom admin roles in Enterprise and per-domain TLS enforcement for email.

     • Adds custom admin roles to Sophos Central Enterprise that restrict access to specific products and prevent policy editing or application
     • Enables enforcing TLS secure communications by domain for both inbound and outbound mail in Sophos Email

     2 details in Everything

115. June 24, 2019 Jun 24, 2019 · release notes

     Sophos Central June 2019 adds UEM health dashboard, email quarantine for unscannable items, customizable smart banners, and new Cloud Optix visualizations.

     └──▷ HOW TO FIND IT
     Quickly assess the health status of managed devices directly from the central dashboard without navigating deep into menus.
     📍View the UEM Health widget on the main Sophos Central dashboard.
     Prevent potential threats by quarantining emails containing attachments that Sophos Email's engine cannot inspect.
     📍In Sophos Email settings, enable Quarantine un-scanned emails for items like encrypted zips or corrupt files.
     Tailor the messaging in smart banners to match your organization's specific security policies or branding.
     📍In Sophos Email settings, edit the Customize smart banner text field.
     Visualize AWS infrastructure with integrated Sophos UTM data and adjust scan frequencies for Azure environments in Cloud Optix.
     📍In Sophos Cloud Optix, navigate to Network Visualizations › AWS or Azure and configure the scan frequency setting.
     • Adds a Unified Endpoint Management (UEM) health overview on the main Sophos Central dashboard to instantly see endpoint status.
     • Enables quarantining of emails that cannot be scanned or accessed in Sophos Email (e.g., encrypted zips, corrupt files).
     • Allows customization of text displayed in smart banners within Sophos Email.
     • Adds network visualizations for AWS showing Sophos UTMs, Azure security/compliance features, GCP visualizations, and configurable scan frequency to Sophos Cloud Optix.

     4 details in Everything

116. May 7, 2019 May 7, 2019 · release notes

     Sophos Central adds PowerShell capture and customizable email alert settings to Intercept X with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.

     • Intercept X Advanced with EDR now captures all PowerShell activity for review and analysis
     • Global settings in Sophos Central let you configure recipients, distribution lists, and alert frequency or custom rules

     2 details in Everything

117. February 20, 2019 Feb 20, 2019 · release notes

     Sophos Central adds Threat Analysis Center for EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. and global policies for Enterprise sub-estates

     └──▷ HOW TO FIND IT
     Consolidate threat investigations and search history for a multi-device environment without switching views.
     📍In the console, go to Overview › Threat Analysis Center
     Apply uniform security baselines across all organizational sub-estates using a single template.
     📍Create and apply a global template policy in Sophos Central Enterprise settings
     • Adds the Threat Analysis Center in the Overview to consolidate Threat Cases and Threat Searches across all supported device types
     • Enables creation and use of global templates to apply identical base policies to sets of or all sub-estates in Sophos Central Enterprise

     2 details in Everything

118. February 11, 2019 Feb 11, 2019 · release notes

     Sophos Central adds Azure AD sign-in for admins, sub-estate region selection, and Email Encryption EAP

     • Sophos Central Enterprise Super Admins can now select a region when creating a new sub-estate.
     • Sophos Central admins, Sophos Central Enterprise admins, and Self Service Portal users can sign in using Microsoft Azure AD credentials.

     2 details in Everything

119. January 21, 2019 Jan 21, 2019 · release notes

     Sophos Central Partner administrators gain access to audit logs for tracking changes.

     └──▷ HOW TO FIND IT
     Allow Partner administrators to track configuration changes via the web interface.
     📍In the Sophos Central Partner UI, navigate to Audit Logs to view change history.
     Launch phishing simulations in Dutch for awareness training.
     📍In Phish Threat, select Nederlands as the language for new campaigns and courses.
     • Makes Phish Threat available in Dutch for phishing simulation and awareness courses

     1 detail in Everything

120. December 10, 2018 Dec 10, 2018 · release notes

     Sophos Central adds Synchronized Security for email/endpoint, Email Content Control EAP, AWS Security Hub integration, and Partner RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.

     • Synchronized Security now connects Sophos Email and Endpoint Protection to detect and clean up infected computers sending out spam and viruses.
     • Email Content Control early access program allows stopping or quarantining content based on keywords and attachment types in Sophos Email Advanced.
     • Alerts integrated into AWS Security Hub for consolidation across AWS, with S3 bucket health reporting highlighting critical misconfiguration.
     • Sophos Central Partner now supports global policies to manage base settings and create templates for customer groups.
     • Sophos Central Partner includes role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) allowing pre-defined roles for admin access levels.

     5 details in Everything

121. November 19, 2018 Nov 19, 2018 · release notes

     Sophos Central adds Intercept X Advanced with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. and Synchronized Security between Email Advanced and Phish Threat

     • Introduces Intercept X Advanced with EDR offering intelligent Endpoint Detection and Response features to report on security posture and detect previously unnoticed attacks.

     1 detail in Everything

122. November 1, 2018 Nov 1, 2018 · release notes

     Sophos Central adds new Alert Details View in Alerts page with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Threat Case links

123. October 29, 2018 Oct 29, 2018 · release notes

     New FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. for Windows, macOS message relay support, Phish Threat Outlook add-in, and enhanced management controls in Central.

     └──▷ HOW TO FIND IT
     Configure Windows Server FIM coverage via the Central console.
     📍Navigate to Device Protection › File Integrity Monitoring › Add Policy for Windows Servers.
     Report a suspected phishing email using the new Outlook integration.
     📍In Outlook, click Report Phish in the Phish Threat toolbar.
     • Adds File Integrity Monitoring (FIM) for Windows servers to track unplanned changes to critical system files
     • Enables Message Relays to automatically serve macOS devices alongside Windows endpoints
     • Introduces the Phish Threat Outlook add-in for reporting phishing directly from the email client
     • Renames Root Cause Analysis to Threat Cases in the UI with updated investigation capabilities
     • Adds Sophos Wireless debugging, audit, and accounting features for APX series access points

     +1 more show less

     • Allows Enterprise Super Administrators to disable enterprise management, unlink sub-estates, or delete sub-estates for individually-licensed accounts

     6 details in Everything

124. October 8, 2018 Oct 8, 2018 · release notes

     Sophos Central EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. EAP gains Deep Learning malware analysis for detailed file attribute and code comparison.

     • Adds Deep Learning malware analysis engine to the Endpoint Detection & Response Early Access Program (EDR EAP)

     1 detail in Everything

125. October 2, 2018 Oct 2, 2018 · release notes

     Intercept X agent now supports Windows 10 Redstone 5 and Windows Server 2019

126. August 7, 2018 Aug 7, 2018 · release notes

     People pages in Overview and Products sections gain sortable columns, full-text search, Last Active, and Group Name fields

     └──▷ HOW TO FIND IT
     Identify inactive devices or accounts by sorting the Last Active column descending on the Users tab.
     📍In the console, go to Overview › People and click the Users tab. Click the Last Active column header to sort.
     Quickly locate a specific user by filtering across all visible fields on the Users tab.
     📍In the console, go to Overview › Products › People. Click the Users tab and use the search box to filter by name or group.
     • Adds Last Active column to People pages
     • Adds Group Name column to People pages
     • Makes all columns on the Users tab of People pages sortable
     • Makes all data on the Users tab of People pages searchable

     4 details in Everything

127. July 24, 2018 Jul 24, 2018 · release notes

     Intercept X Advanced for Server is now generally available with new deep learning and exploit prevention capabilities.

128. July 17, 2018 Jul 17, 2018 · release notes

     Sophos Central adds Root Cause Analysis for servers, new APX Series wireless support, and server protection name changes.

     • Root Cause Analysis added to Intercept X Advanced for Server to investigate malware infection chains
     • Support for APX Series access points enabling Synchronized Security between Wireless, Endpoint and Mobile
     • New DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. capability available in Server Protection (formerly Server Protection Standard)

     3 details in Everything

129. June 19, 2018 Jun 19, 2018 · release notes

     Sophos Central introduces Email Advanced with sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. and adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for Enterprise

     • Adds new features for Email Standard including DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. and DMARC support
     • Adds role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) for Sophos Central Enterprise to manage admin access levels

     2 details in Everything

130. June 11, 2018 Jun 11, 2018 · release notes

     Sophos Central adds Windows Firewall monitoring/control, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. updating, improved alert grouping/filters, and Intercept X APCI

     • Adds HTTPS updating as a single global setting to enable secure updates for Windows, macOS and Linux endpoints
     • Adds Windows Firewall monitoring and control of active state for public, private or domain connections on most Windows desktops and servers
     • Adds new alert options: viewing and resolving alerts in groups, using new filters, and controlling email alert recipients and frequency
     • Adds a new exploit mitigation in the Server Protection – Intercept X Early Access Program (Beta) to detect abuse of Application Procedure Calls

     4 details in Everything

131. May 14, 2018 May 14, 2018 · release notes

     Sophos Central adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. sign-in and unattended Device Encryption activation.

     └──▷ HOW TO FIND IT
     Sign in to Central Admin using an SMS code instead of a TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. app.
     📍1. Go to Account Details › Account Preferences to configure or verify SMS MFA settings. 2. Initiate login and choose the SMS text message option for the second factor.
     Deploy Device Encryption without requiring a user to enter credentials at startup.
     📍1. Open the updated Encryption dashboard. 2. Set Require startup authentication to off to enable unattended activation.
     • Adds SMS text message as a supported second factor for signing in to Sophos Central Admin or Enterprise
     • Enables unattended activation for Device Encryption when Require startup authentication is off

     2 details in Everything

132. April 24, 2018 Apr 24, 2018 · release notes

     AWS map in Server Protection adds discovery of workloads across all public AWS regions.

     • Adds a map view for AWS workloads in Server Protection
     • Enables discovery of workloads in every public AWS region, including those not actively used

     2 details in Everything

133. March 6, 2018 Mar 6, 2018 · release notes

     Sophos Central adds Remote Desktop license tracking for Server Protection and Server Lockdown on Windows Server 2016.

     • Adds Remote Desktop Services support including license usage tracking to Server Protection.
     • Enables use of Server Lockdown on Windows Server 2016.
     • Allows updating Linux servers and Macs from a local update cache on your network.

     3 details in Everything

134. February 12, 2018 Feb 12, 2018 · release notes

     Sophos Central adds non-expiring installer for Windows and macOS support for OS X 10.9 (ended), plus network cache installation.

     • New non-expiring Sophos Endpoint installer for Windows replaces the old expired version
     • Released a new Sophos Endpoint installer for macOS replacing outdated versions that stopped working in mid-February
     • Adds ability to perform initial installation of Sophos Endpoint on Windows from a network update cache

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Old macOS Sophos Endpoint installers stopped working in mid-February and must be replaced with the new version
     • !OS X 10.9 support ended as of last April; Macs running OS X 10.9 will stop getting updates with Sophos Anti-Virus for macOS 9.7.4