https://cybertoolchain.io/tools/sophos-central New releases and features in Sophos Central, tracked by The Cyber Toolchain. en Mon, 12 Oct 2026 17:38:41 GMT https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 12 Oct 2026 17:38:41 GMT Sophos Central adds AI agent identity visibility, Dark Web Monitoring domain verification, phishing protection in Protected Browser, and transaction re-auth for sensitive ops⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Surfaces every AI agent, blueprint, and app created by Microsoft Entra — including owner and sponsor — under Non-Human Identities in the Directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds manual domain entry and DNS TXT record ownership verification for Dark Web Monitoring, removing the requirement to sync domains from Entra ID. • Delivers Phishing Protection in Protected Browser to guard organizational credentials, adds direct DNS Protection independent of endpoint or network policies, provides a new MSI installer for easier Windows deployment of Protected Browser, and adds more flexible data boundary controls. • Requires administrators to re-authenticate before running Live Response and sensitive Response Actions via transaction authentication. • Shows application status for each policy on the Policies tab of an endpoint's details page, so admins can confirm when an updated policy has taken effect. • Scales bulk endpoint actions on the 'Computers and servers' page to tens of thousands of devices, with long-running actions continuing in the background. • Adds alerts for Microsoft Entra ID and Google Directory synchronization — covering successful syncs, warnings, errors, oversized synchronizations, and deactivations — surfaced on the 'Alerts' page. • Adds AP6 MR10 firmware support for Microsoft Entra ID authentication and Per-SSID RADIUS management. • Enables scheduling of Entra ID synchronization as frequently as every 30 minutes, with enhanced multi-value operator filtering and selective device-attribute sync. • Enables deletion of old, unused on-premises Active Directory sources directly from the Sophos Fusion interface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 12 Oct 2026 00:00:00 GMT Sophos Central adds AI agent and non-human identity visibility in Entra, endpoint policy status, and phishing protection in Protected Browser⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Sophos ITDR now surfaces AI agents, blueprints, and apps created by Microsoft Entra — including ownership and sponsorship — under Non-Human Identities in the Directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • See the application status for each policy on the Policies tab of an endpoint's details page, including confirmation that updated policies (such as exclusions) have been applied. • Protected Browser now adds Phishing Protection to guard organizational credentials, direct DNS Protection independent of endpoint or network policies, a new MSI installer for Windows deployment, and more flexible data boundary controls. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Sat, 05 Sep 2026 07:37:31 GMT Sophos ITDR gains on-premises Active Directory support, a redesigned Identity Overview dashboard, and posture check filtering. • Adds on-premises Active Directory (AD) support to Sophos ITDR — deploy the new sensor to an AD server to extend monitoring and posture assessments beyond cloud identity. • Redesigns the Identity Overview dashboard with new widgets for risk trends, MFA coverage, dormant accounts, credential leaks, and VIP users. • Redesigns the Posture Check page with filtering, sorting, and searching by category, provider type, and status, plus tag chips, a live match counter, and a 'NEW' badge for recently published checks. • Rolls out an updated threat protection policy page with a clearer layout, filters, and the option to add explanatory notes to settings and exclusions. • Adds guided ZTNA workflows for securing SaaS apps via Protected Browser, including data boundaries, device posture checks, and in-browser RDP and SSH access under the Workspace Protection license. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 17 Aug 2026 09:02:18 GMT Sophos Central adds AI Defense EAP, ITDR Identity Risk Scores, new ITDR regions, and a Generative AI DNS filtering category. • Adds a 'Generative AI' category to DNS Protection filtering policies, giving visibility into AI service usage on networks and enabling policy-based control. • Introduces Identity Risk Scores in Sophos ITDR — a single ML-derived score combining incident likelihood and compromise impact, updated dynamically as findings and accounts change. • Launches Sophos AI Defense Early Access Program for Sophos EDR, XDR, and MDR customers on Sophos Fusion, enabling monitoring, control, and security of AI usage across an environment. • Expands Sophos ITDR availability to tenants provisioned in Canada, Australia, Japan, India, and Brazil. • Enables partners to explicitly select individual add-ons and products when applying bulk license changes to multiple monthly-usage customers simultaneously. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Wed, 12 Aug 2026 09:48:11 GMT • Sophos ITDR now assigns every identity a Risk Score — a single ML-derived number combining incident likelihood with potential impact — updated dynamically as findings and accounts change. • DNS Protection adds a Generative AI category, enabling visibility into AI-service usage on the network and policy-level control over generative AI in DNS filtering rules. • Partner portal now supports explicit selection of add-ons and products when applying bulk license changes to multiple monthly-usage customers simultaneously. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://www.sophos.com/en-us/blog/sophos-ai-defense https://www.sophos.com/en-us/blog/sophos-ai-defense Tue, 11 Aug 2026 09:15:20 GMT Sophos adds AI Defense EAP, ITDR identity risk scores, new ITDR regions, and generative AI DNS filtering category • Adds 'Generative AI' as a new category in DNS Protection filtering policies, giving visibility into and control over AI services on your networks. • Launches Sophos AI Defense Early Access Program for Sophos EDR, XDR, and MDR customers on Sophos Fusion — enables monitoring, control, and securing of AI usage across an environment. • Introduces Identity Risk Scores in Sophos ITDR: a single ML-powered score per identity combining incident likelihood with potential impact, updating dynamically as findings and accounts change. • Expands Sophos ITDR availability to customers with tenants provisioned in Canada, Australia, Japan, India, or Brazil. • Improves bulk license management for partners: monthly-usage customer license changes now support explicit selection of add-ons and products when applied in bulk. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 10 Aug 2026 00:00:00 GMT Sophos adds AI Defense EAP, ITDR Identity Risk Scores, new ITDR regions, and a Generative AI DNS filtering category. • New 'Generative AI' category in DNS Protection filtering policies gives visibility into and control over AI service usage on your networks. • Sophos AI Defense (Early Access Program) lets EDR, XDR, and MDR customers on Sophos Fusion monitor, control, and secure AI usage across their environment. • Sophos ITDR now surfaces a Risk Score per identity, combining breach likelihood with potential impact, powered by a patent-pending ML model that updates as findings and accounts change. • Sophos ITDR expands regional availability to Canada, Australia, Japan, India, and Brazil. • Partner portal bulk license workflow now lets administrators explicitly select add-ons and products when applying changes to multiple monthly-usage customers simultaneously. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 20 Jul 2026 13:25:16 GMT Sophos Central adds Network Map, Live Discover for AP6, DNS Protection APIs, Protected Browser extension, and a wave of new alerts and email capabilities. • New Network Map provides a visual topology of all Sophos firewalls, switches, and AP6 access points with search and relationship views. • Live Discover queries now support AP6 Series access points, enabling on-demand SQL queries against wireless data in the Sophos data lake. • New Protected Browser extension lets admins apply security policies and monitor user activity in Chrome and Edge without requiring migration to the full Protected Browser. • Web control adds filtering for Generative AI sites, more granular per-site controls, and simplified policy management. • New alerts for Account Health Check (AHC) issues now surface unaddressed AHC findings directly in the alerts feed. • Protected Browser gains a categorized app picker for Generative AI policy creation and new reporting on file uploads and downloads. • DNS Protection endpoint and DNS filtering policies are now managed on a single page for Workspace Protection customers. • Administrators will soon be required to register at least two MFA methods; a grace period allows registration of a second method at sign-in. • New alert fires when API credentials (including AD Sync) are 30, 7, or 1 day from expiration. • New alert fires when a Super Admin or Admin role is assigned or removed. • Public RESTful APIs for DNS Protection core configuration are now generally available. • New Security Services Retainer provides flexible access to Advisory and Professional services plus guaranteed emergency incident response. • Global Settings replaces General Settings with use-case-driven categories, search, filters, and a left-panel index. • New Sophos Email Plus license tier extends Message History and Quarantine retention to 90 days, adds Message Replay, Contact Trace and Recall, and bundles DMARC Manager. • M365-quarantined emails can now be viewed and managed directly within Sophos Central without switching to the M365 portal. • Email: Newly Registered Domain (NRD) Protection detects and acts on emails from recently registered domains before delivery. • Sophos Email TLS report now includes MFR-mode emails, providing full visibility into TLS encryption across all processed mail. • Workspace Protection is generally available, bundling Sophos Protected Browser, DNS Protection, ZTNA, and Email Monitoring System. • Device tagging is generally available with tag-based filtering, search-box tag queries, configurable tag column, install-time tagging, and tag suggestions. • Partner Super Admins can now reset MFA for users and admins in managed customer tenants. • PSA tickets for Autotask and ConnectWise are now enriched with Integrated MSP Tool data. • AI Assistant adds access to Self-managed and Sophos-managed cases, pinned content, structured feedback tags, and the ability to save and reuse custom prompts. • Unauthorized File Protection is a new capability that prevents malicious executables from running on Windows servers. • AP6 Series MR8 adds WPA2/WPA3 Enterprise Authentication, adjustable MAC filtering, and increases the maximum MAC list size to 4096 addresses per SSID. • Managed Risk now includes authenticated internal vulnerability scanning for deeper visibility beyond unauthenticated scans. • Sophos Switch management gains STP (Spanning Tree Protocol) configuration in Sophos Central. • Email TLS report shows which TLS version was applied per message and reasons for non-delivery due to Secure Message Policy TLS requirements. • AI Search for natural-language queries against security data is generally available for all Sophos XDR and MDR customers, now including endpoint telemetry. • AI Case Summary and AI Command Line analysis are generally available for accelerating investigations. • Sophos DMARC Manager add-on provides DMARC, SPF (with flattening), and DKIM management and reporting, plus BIMI, MTA-STS, and TLS-RPT. • Integration health alerts now fire in Sophos Central and via email when a third-party MDR/XDR data ingestion integration is unhealthy or offline. • Central Switch Stacking provides a management overlay to simplify administration of stacked Sophos switches. • Usage Insights for AP6 Series access points is now available in Sophos Central Wireless. • Sophos Advisory Services adds proactive security testing and independent cyber-defense assessments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 20 Jul 2026 00:00:00 GMT Sophos Central adds Network Map topology visualization, AP6 Live Discover queries, and a Protected Browser extension for Chrome and Edge. • New Network Map provides a visual representation of Sophos network topology, showing relationships and connections between all Sophos firewalls, switches, and AP6 access points in a Central account, with search capabilities. • Live Discover queries now support AP6 Series access points, enabling on-demand querying of wireless data stored in the Sophos data lake. • New Workspace Protection: Protected Browser extension lets administrators apply security policies and monitor user activity in Chrome and Edge without requiring migration to the full Sophos Protected Browser. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://community.sophos.com/sophoswireless/b/blog/posts/introducing-network-map-in-sophos-central https://community.sophos.com/sophoswireless/b/blog/posts/introducing-network-map-in-sophos-central Mon, 20 Jul 2026 00:00:00 GMT Sophos Central adds Network Map visualization, Live Discover queries for AP6 access points, and a Protected Browser extension for Chrome and Edge. • New Network Map provides a visual topology of all Sophos firewalls, switches, and AP6 access points in a Sophos Central account, with device relationship views and search capabilities. • Live Discover queries now support AP6 Series access points, enabling on-demand querying of wireless data stored in the Sophos data lake. • New Protected Browser extension lets administrators apply security policies and monitor user activity in Chrome and Edge without migrating users to the full Sophos Protected Browser. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 13 Jul 2026 10:06:53 GMT Sophos Central adds DNS Protection APIs, Gen-AI web filtering, MFA enforcement, new email tiers, and expanded MDR/XDR capabilities. • Adds Web Control filtering for Generative AI sites with more granular per-site control and simplified policy management. • Enables alerts for Account Health Check (AHC) issues, gradually rolling out to surface unaddressed configuration risks. • Adds categorized Gen-AI app picker in Protected Browser policy creation, plus reporting on file uploads and downloads for risky data flow visibility. • Consolidates DNS Protection Endpoint and DNS filtering policies onto a single management page for Workspace Protection customers. • Requires administrators to register at least two MFA methods for sign-in to reduce lockout risk. • New alert: API credential expiration warnings at 30 days, 7 days, and 1 day before expiry (including AD Sync credentials). • New alert: Super Admin or Admin role assignment and removal events for rapid detection of unexpected privilege changes. • Introduces public RESTful APIs for managing core DNS Protection configuration. • Adds Security Services Retainer offering flexible access to Advisory and Professional services plus guaranteed emergency incident response. • Redesigns Global Settings in Sophos Central with use-case-driven categories, search, filters, and a left-panel index. • Introduces Sophos Email Plus tier with 90-day Message History and Quarantine retention, Message Replay, Contact Trace and Recall, and bundled DMARC Manager. • Enables viewing and managing M365-quarantined emails directly within Sophos Central. • Adds Newly Registered Domain (NRD) Protection in Sophos Email to detect and block phishing and spam from recently registered domains. • Includes MFR-mode emails in the Sophos Email TLS report for complete encryption visibility across all processed mail. • Launches Workspace Protection (Sophos Protected Browser, DNS Protection, ZTNA, Email Monitoring System) as a generally available product suite. • Promotes Device Tagging to GA, adding tag-based device filtering, install-time tagging, and tag auto-suggest. • Enables Partner Super Admins to reset MFA for users and admins in managed customer tenants. • Enriches Sophos PSA Tickets with Integrated MSP Tool Data for Autotask and ConnectWise PSA. • Expands AI Assistant with access to Self-managed and Sophos-managed cases, pinned content, structured feedback tags, and saved/reusable custom prompts. • Introduces Unauthorized File Protection to prevent malicious executables from running on Windows servers. • Adds authenticated internal vulnerability scanning to Sophos Managed Risk for deeper vulnerability visibility. • Delivers Usage Insights for AP6 Series access points in Sophos Central Wireless. • Adds STP (Spanning Tree Protocol) management for Sophos Switches in Sophos Central. • Makes AI Search (natural-language security data queries) generally available for all Sophos XDR and MDR customers, now including endpoint telemetry. • Promotes AI Case Summary and AI Command Line Analysis to general availability. • Introduces DMARC Manager as an add-on with DMARC/SPF/DKIM management, SPF flattening, BIMI, MTA-STS, and TLS-RPT. • Generates integration health alerts and admin email notifications when MDR/XDR data ingestion integrations are unhealthy or offline. • Introduces Central Switch Stacking management overlay to simplify administration of stacked Sophos switches. • Adds Internal Attack Surface Management (IASM) to Managed Risk, powered by Tenable Nessus, at no additional cost. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 08 Jun 2026 00:00:00 GMT Sophos Central adds DNS Protection APIs, credential expiration alerts, and admin assignment alerts. • Adds new alert for API credential expiration (30 days, 7 days, and 1 day) • Adds new alert for Super Admin or Admin assignments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 18 May 2026 00:00:00 GMT Sophos Central adds Security Services Retainer for advisory and emergency response access • Adds `Security Services Retainer` to Sophos Central, providing flexible access to Advisory and Professional services plus guaranteed emergency incident response Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 27 Apr 2026 00:00:00 GMT Sophos Central adds Global Settings redesign, self-healing alerts, M365 quarantine integration, and NRD email protection. • `Global Settings` replaces `General Settings` with use-case-driven categories and search • View and manage emails quarantined by M365 directly from Sophos Central • Newly Registered Domain (NRD) Protection detects and acts on emails from recently registered domains Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Tue, 07 Apr 2026 00:00:00 GMT Sophos Email TLS report now covers MFR-mode emails for full encryption visibility across all processed mail. • Extends the TLS report to include MFR-mode emails, giving full visibility into TLS encryption across every email processed by Sophos Email. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 16 Mar 2026 00:00:00 GMT Workspace Protection GA, device tagging GA, Partner MFA reset, and PSA ticket enrichment • Adds `steps` for Workspace Protection (Protected Browser, DNS Protection, ZTNA, Email Monitoring) to the Free Trials menu • Adds device tagging capabilities including tag filtering in search/filters and tag suggestions during install or list view • Adds Partner Super Admin ability to reset MFA for users/admins in managed customer tenants • Adds Integrated MSP Tool Data enrichment to Sophos PSA Tickets for Autotask and ConnectWise Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 23 Feb 2026 00:00:00 GMT Sophos Central adds unauthorized file protection for Windows servers and AI Assistant prompt management. • Introduces `Unauthorized File Protection` to prevent malicious executables from running on Windows servers • Adds the ability to save, reuse, and manage custom prompts across chats in the AI Assistant • Adds structured tags for feedback in the AI Assistant • Adds pinned content support in the AI Assistant • Expands access to both Self-managed and Sophos-managed cases in the AI Assistant Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Tue, 20 Jan 2026 00:00:00 GMT Sophos Central introduces early access for 'Sophos Protected Browser' as part of the Workspace Protection suite. • Adds `Sophos Protected Browser` to the early access program, providing a managed environment for business apps and web usage within the Workspace Protection product suite. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 12 Jan 2026 00:00:00 GMT Sophos AP6 Series MR8 adds WPA2/WPA3 Enterprise Authentication and raises MAC filter list to 4096 addresses per SSID. • Adds WPA2/WPA3 Enterprise Authentication support to AP6 Series wireless access points. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 15 Dec 2025 00:00:00 GMT Beta device tagging available in Computers and servers list; updated Update Licenses UI • Adds beta device tagging capability with a banner on the 'Computers and servers' list • New look for monthly licensing updates via Update Licenses assistants Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 24 Nov 2025 00:00:00 GMT Sophos Central Managed Risk adds authenticated scanning; Device List gains user search and last update time column. • Adds `Managed Risk` support for authenticated internal vulnerability scanning to uncover deeper visibility into potential vulnerabilities • Adds user search capability and an optional 'last agent update time' column to the 'Computers and servers' page in Device List Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 13 Oct 2025 00:00:00 GMT Sophos Central adds Sophos Advisory Services offering proactive security testing. • Adds 'Sophos Advisory Services', a new service for proactive security testing and independent assessment of cyber defenses Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 15 Sep 2025 00:00:00 GMT Sophos Central adds Usage Insights for AP6 Series access points; updates custom alert rules with integration health category. • Delivers Usage Insights for Sophos Central Wireless AP6 Series customers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 11 Aug 2025 00:00:00 GMT Sophos Central adds STP switch management and TLS encryption visibility reports. • Delivers management for Spanning Tree Protocol (STP) features for Sophos switches • Provides the TLS report with visibility of message encryption versions and non-delivery reasons Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html Sat, 09 Aug 2025 00:00:00 GMT Sophos Central 2025.32 adds STP management for Sophos Switches and a new TLS Report for Sophos Email. • Adds STP (Spanning Tree Protocol) management for Sophos Switch hardware via Sophos Central, alongside Maintenance Release 02.1.1837 for all Sophos Switch devices. • Adds a TLS Report in Sophos Email that shows which TLS version was applied to each message and the reason for non-delivery when a message failed Secure Message Policy TLS requirements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 21 Jul 2025 00:00:00 GMT Sophos Central July 2025 adds AI Search, AI Case Summary, DMARC Manager, integration health alerts, and Switch Stacking • AI Search is now available for all Sophos XDR and Sophos MDR customers with endpoint telemetry and detection data query support • Sophos AI Case Summary and AI Command Line analysis are generally available to accelerate investigations • DMARC Manager add-on provides comprehensive management and reporting of DMARC, SPF, DKIM records, including SPF flattening, BIMI, MTA-STS, and TLS-RPT • Integration health alerts generate notifications when third-party data ingestion integrations are unhealthy or offline for MDR and XDR customers • Central Switch Stacking provides a management overlay to simplify managing Sophos switches in a wired stack Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html Sat, 19 Jul 2025 00:00:00 GMT Sophos Central 2025.29 adds DMARC Manager, integration health alerts, Switch Stacking, and GA for AI Case Summary and AI Search. • Adds Sophos DMARC Manager add-on for comprehensive management and reporting of DMARC, SPF, and DKIM records, including SPF flattening, BIMI, MTA-STS, and TLS-RPT. • Generates alerts in Sophos Central and sends email notifications to admins when a data ingestion integration is unhealthy or offline, covering all third-party integrations for MDR and XDR customers. • Adds Central Switch Stacking to reduce management complexity when running Sophos switches wired together as a switch stack. • Promotes AI Case Summary and AI Command Line Analysis to general availability for faster investigations and clearer insights. • Makes AI Search — natural-language querying of security data — generally available to all Sophos XDR and MDR customers, now including endpoint telemetry alongside detection data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html Sat, 28 Jun 2025 00:00:00 GMT Sophos Managed Risk gains internal attack surface management via Tenable Nessus; AP6 Series adds multiple mesh SSID support. • Adds Internal Attack Surface Management (IASM) to Sophos Managed Risk, extending vulnerability management to internal assets using Tenable Nessus technology, available to all new and existing Managed Risk customers at no additional cost. • Adds multiple mesh SSID support for Sophos AP6 Series access points in Sophos Central. Breaking changes: • The 'Apply License Key' button is removed for MSP tenants on the Partner Dashboard; MSP tenants must now update licenses exclusively through the 'Update Billing' conversion flow from MSP to Term. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html Sat, 07 Jun 2025 00:00:00 GMT Sophos Central 2025.23 adds MDR integration health alerts, ZTNA on-premises network detection, and a device details flyout. • Adds MDR integration health alerts in Sophos Central when a data ingestion integration is unhealthy or offline, starting with the Microsoft 365 Management Activity integration, with email notification support. • Adds on-premises network detection and domain controller support as an agent-based resource in ZTNA, improving usability and performance. • Adds a device details flyout that opens when clicking a device in the 'Computers and servers' page, keeping context on the same page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 19 May 2025 00:00:00 GMT Sophos Central adds AI Search for endpoint data and Microsoft 365 Response Actions for MDR • Enables `AI Search` for endpoint data in the New AI Features EAP, allowing natural language queries against the Sophos Data Lake • Adds `M365 Response Actions` integration to let MDR analysts contain and neutralize attacks in Microsoft 365 environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_platform_rn.html Sat, 17 May 2025 00:00:00 GMT Sophos Central 2025.20 adds AI Search for endpoint data and MDR Microsoft 365 Response Actions. • Adds MDR Microsoft 365 Response Actions integration, enabling MDR analysts to contain and neutralize attacks in a customer's M365 environment; included in all MDR licenses at no additional cost. • Extends XDR AI Search (New AI Features EAP) to endpoint data in the Sophos Data Lake, allowing analysts to query endpoint telemetry using natural language in addition to detections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 07 Apr 2025 00:00:00 GMT Sophos Central ZTNA agent adds inactivity timeout and connection pooling controls; DNS Protection expands to new regions. • ZTNA maintenance release 2.1.2 offers options to modify the agent's tunnel inactivity timeout. • ZTNA maintenance release 2.1.2 offers an option to disable connection pooling for agentless resources. • DNS Protection can now be managed by tenants in the Australia, Brazil, Canada, India, and Japan data regions. Breaking changes: • SMS and Email+PIN legacy authentication methods are retired for Central sign-in. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 10 Feb 2025 00:00:00 GMT Sophos Central Feb 10 2025 release adds AI Assistant in New AI Features EAP • Enrolls eligible customers in the 'New AI Features EAP' to access 'AI Assistant', a GenAI-powered triage and investigation tool using natural language. • Provides the capability for users to interact with the Sophos XDR platform via natural language queries to accelerate case triage and investigation workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Wed, 15 Jan 2025 00:00:00 GMT Sophos Central adds GeoDNS for DNS Protection, PDF Account Health reports, ConnectWise/Autotask firewall sync, and ZTNA mgmt in new regions. • Adds support for improved GeoDNS responses in DNS Protection to target networks by geographical location • Adds AP6 Series MR5 access point support for Guest Network NAT mode and power statistics in Sophos Central • Adds loopback detection, DoS, and log settings management for Switch devices from Sophos Central • Adds the ability to export a PDF report of the Account Health Check dashboard for external stakeholders • Adds Let's Encrypt support for automated gateway certificate management in ZTNA (available mid-January) • Expands ZTNA management availability on Sophos Central to tenants in Australia, Brazil, Canada, India, and Japan • Adds monthly firewall product sync capability to ConnectWise PSA and Autotask usage sync integrations • Adds configurable sync frequency for ConnectWise PSA integration to align license quantities with the invoice Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Tue, 03 Dec 2024 00:00:00 GMT Sophos Central adds Sophos Mobile API GA, alert filtering for PSA integrations, and SPL on-access scanning • Makes the Sophos Mobile API generally available to manage enrolled devices • Adds support for multiple alert filtering rules in Partner PSA ticketing integrations • Adds on-access anti-malware scanning to the Sophos Protection for Linux (SPL) Agent Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 11 Nov 2024 00:00:00 GMT Sophos Central November 11 release adds Mailbox Management API and replaces device lists. • Adds the `Mailbox Management API` to allow creating, reading, searching, updating, and deleting mailboxes in Sophos Email. • Replaces the old devices lists with the new 'Computers and servers' list, offering improved searching, more device details, and better performance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Wed, 02 Oct 2024 00:00:00 GMT Sophos Central adds AI Search for Detections in EAP, expands Switch management regions, and retires legacy dashboard toggle • Enables 'AI Search for Detections' in New AI Features EAP to query Sophos Data Lake using natural language • Adds switch management availability in Sophos Central for tenants in Australia, Brazil, Canada, India, and Japan • Adds Bounce Address Tag Validation (BATV) configuration for gateway domains in Sophos Email to defeat backscatter attacks • Updates Partner PSA integration so firewall tickets are associated with the corresponding PSA configuration item Breaking changes: • The toggle to switch between dashboards in the legacy Threat Analysis Center is removed as the legacy dashboard has been retired. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 19 Aug 2024 00:00:00 GMT NDR 1.7 adds investigation console and product pages; PSA integrations support Sophos Switch/AP6 license syncing • Adds an NDR investigation console in Sophos Central with the release of NDR 1.7. • Introduces new product pages for tools within Sophos Central as part of the NDR 1.7 update. • Expands Autotask and ConnectWise PSA integrations to map and sync monthly support license usage for Sophos Switch and AP6 devices. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Wed, 31 Jul 2024 00:00:00 GMT Sophos Central EAP introduces AI features for analyst efficiency; RMM plugins now support Macs without customer tokens • Adds Early Access Program (EAP) for new AI-powered features to test enhanced threat investigation and analyst efficiency. • ConnectWise Automate plugin updates allow managing Macs, a capability previously only available in the Kaseya VSA plugin. • RMM plugins for ConnectWise Automate and Kaseya VSA no longer require customer tokens or product selection to deploy Sophos agents. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 08 Jul 2024 00:00:00 GMT Sophos Central adds Microsoft Graph Security V2 integration, public APIs for Detections/Cases, and a new alerts dashboard. • Adds `Microsoft Graph Security V2` integration for threat investigation in Sophos XDR and MDR • Releases two new public APIs for integration with `Detections` and `Cases` in Sophos XDR • Adds a pre-defined `All alerts` dashboard accessible via the `Find Dashboards` feature Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Wed, 19 Jun 2024 00:00:00 GMT Sophos Central adds F5/Forcepoint integrations, Autotask PSA ticketing, DNS Protection GA, and new device list columns with CSV export. • Adds `F5 BIG-IP Application Security Manager` and `Forcepoint NGFW` integrations for Sophos MDR/XDR customers with the Firewall integrations license pack • Adds `device group` and `tamper protection` columns, tamper protection status filtering, a column selector, and CSV export to the new Computers & Servers list • Makes Sophos DNS Protection generally available as a new product for network environments providing monitored cloud DNS resolution • Adds Autotask PSA ticketing integration allowing alert tracking as PSA tickets and acknowledgement/closure from either platform • Adds auto-assignment of Autotask tickets to customer, priority, and category upon integration setup • Adds links to Sophos device details pages in ConnectWise PSA and Autotask tickets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Thu, 30 May 2024 00:00:00 GMT Sophos Central adds custom dashboards, enhanced devices list with search, and NDR hardware appliance support • Adds flexible, interactive custom dashboards for optimizing user operations • Enhances the 'Computers & Servers' list with resizable columns, improved 'Last active' details, and a search bar for device name, IP, and OS fields • Enables Sophos NDR sensor deployment on certified hardware appliances supporting up to 40 Gbps and 120K connections per second Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Tue, 07 May 2024 00:00:00 GMT Sophos Central adds Sophos Managed Risk service, Linux device isolation, MFA expansion, and macOS scheduled updates • New Sophos Managed Risk service combines Tenable technology with Sophos MDR threat expertise for proactive vulnerability management. • Expanded multi-factor authentication (MFA) coverage to Self Service Portal, Sophos ID landing page, Sophos Community, Partner Portal, and Sophos Support. • Device isolation support now available for Linux devices within Sophos Central. • macOS updates can now be scheduled via Update Management policy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Tue, 02 Apr 2024 00:00:00 GMT Usage sync now requires manual PSA product creation instead of auto-provisioning for Autotask and ConnectWise. • Updates `Autotask` integration to only create PSA products on request rather than automatically when usage sync is enabled • Updates `ConnectWise` integration to only create PSA products on request rather than automatically when usage sync is enabled • Improves the product mapping user experience for MSPs using usage sync Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 04 Mar 2024 00:00:00 GMT Sophos Central adds MFA validation for user profile updates and AWS AMI deployment for NDR/log collectors • Requires MFA validation before users can view, add, or remove their own MFA settings in Sophos Central • Enables deployment of NDR and third-party log collector integrations via a new AWS AMI available on the AWS Marketplace Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Wed, 21 Feb 2024 00:00:00 GMT Sophos DNS Protection EAP adds custom report template saving, multi-format export, and scheduled reporting. • Adds the ability to save your own report templates in Sophos DNS Protection EAP • Enables exporting reports in various formats via the Sophos DNS Protection EAP • Allows scheduling of automated reports within the Sophos DNS Protection EAP Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 12 Feb 2024 00:00:00 GMT New QUIC blocking policy option, Linux Security Health updates with Runtime Detections, and granular Data Control search fields • Adds `QUIC` protocol blocking as an endpoint/server threat protection policy option • Expands Sophos Central Linux Security Health to include "Sophos Linux Runtime Detections" • Enhances Data Control policy with granular search configuration for subject, message body, attachment name, and attachment content Breaking changes: • Access to the legacy Investigations feature is removed at the end of February; use Cases instead Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 22 Jan 2024 00:00:00 GMT Sophos Central introduces new navigation and a notifications center in January 22, 2024 update. • New navigation menus and shortcuts with easier access • New notifications center added to the interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 08 Jan 2024 00:00:00 GMT Sophos Central adds AP6 mesh support, SNMP/LLDP management, and Autotask product mapping in Jan 8 release. • Extends change conflict detection to network ports • Enables AP6 Series access points to be configured as a wireless mesh network • Adds `Product Mapping` in Central Partner to sync usage with Autotask Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html Mon, 11 Dec 2023 00:00:00 GMT Sophos Central adds QUIC blocking, Sophos DNS Protection product, Email clawback, and XDR Okta integration. • Adds a new option in endpoint and server threat protection policies to block browser traffic using the QUIC protocol • Introduces 'Sophos DNS Protection', a new cloud-based DNS resolution service product for network environments • Enables manual on-demand clawback of messages from M365 inboxes into Sophos Email post-delivery quarantine • Adds Okta as an integrated third-party response action within XDR Cases Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-central