Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Sophos Firewall: DNS enhancements

Sophos Firewall v23 brings new DNS enhancements including DNS-over-HTTPS (DoH) support, DNS security extension (DNSSEC) support, and one-click Secure DNS set up, made possible through native integration with Sophos Fusion. Learn about the new enhancements and the steps to set up Secure DNS Protection, third-party DNS services, and DNSSEC protection. Ask questions and get expert answers in the Sophos Community.

Sophos ITDR expands identity protection for the AI era

Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment. Identity has become one of the most targeted attack surfaces in cybersecurity, with attackers increasingly relying on stolen credentials, compromised sessions, excessive privileges, and identity misconfigurations to gain access.

Sophos Fusion: Securing the AI Era for MSPs

Discover how Sophos Fusion helps Managed Service Providers (MSPs) simplify operations, improve security outcomes, and grow profitability with an AI-native cybersecurity defense system. Chapters Introduction to Sophos Fusion Unified Defense vs. Disconnected Tools Connected Protection Stack (Endpoint, Firewall, Email, MDR, Identity, Network) Shared Intelligence and Unified Response Simplified Management (Multi-tenant, Automation, RMM/PSA Integrations)

Building intent-based access control without reading minds

This article was first published on LinkedIn. In Minority Report, the Department of Precrime promised certainty. Three precognitives saw the future, the system picked the consensus, and police arrested people for murders they hadn't yet committed. The whole machine depended on one buried secret: sometimes the precogs disagreed, and the dissenting vision, the minority report, was quietly deleted. The system held together as long as the precogs agreed, but broke when it removed its own doubt.

Stopping attackers who want your endpoint protection to go dark

EDR Killers let attackers blind endpoint protection before the real attack begins, and Sophos Endpoint stops them with several layers that are on by default. Most people picture a cyberattack as something loud: files encrypting, screens locking, a ransom note. But the attacks that do real damage usually start quietly. Before an attacker steals data or deploys ransomware, they try to make sure nobody is watching. That means dealing with the endpoint protection on the device first.

Sophos AI Defense is now generally available

Bring AI out of the shadows with visibility and control that help your organization adopt AI securely. When we introduced Sophos AI Defense in July, we focused on a challenge facing organizations everywhere: AI adoption is accelerating, often faster than security and IT teams can see or control it. New AI tools, embedded capabilities, and shadow AI are creating blind spots around where AI is being used and what information it can access.

AI governance needs more than a policy document

AI tools have made it remarkably easy for a company to expose its own data: None of these actions seem malicious, but each one moves sensitive information somewhere the security team cannot see. This new era of "move fast and break things”, a phrase famously coined by Mark Zuckerberg in the early Facebook days, benefits attackers. Company data now flows through more places, more third parties, and more delegated credentials.

Introducing Sophos AI Defense

Sophos AI Defense finds the AI tools employees and applications are using, including the ones security teams never approved, and enforces policy wherever they run. Every AI tool an organization can’t see is a potential gap in confidentiality, integrity, and availability. Delivered through Sophos Fusion, the AI-native cybersecurity defense system, Sophos AI Defense connects controls on the device, across the network, at sign-in, and in the browser into one line of defense, so teams can safely adopt AI faster without adding another disconnected tool to manage.

CVE-2026-70111: How Corelight uncovered a 0-Day affecting Microsoft Distributed File System

In the process of fuzzing MS-RPC and Distributed File System (DFS) APIs, we discovered a one-packet mechanism set to crash an entire Windows server, which the Microsoft Security Response Center (MSRC) later assigned as CVE-2026-70111.