Sophos AI Defense: Benefits, Costs and Limitations

An employee asks ChatGPT to correct an email, a developer installs a coding assistant, and a team uploads a spreadsheet for analysis. AI makes work easier, so people often use it before IT has approved it, sometimes deliberately despite a ban. Company data and confidential documents can end up with providers that have not been assessed. Which services are being used, by whom, and how can rules be enforced?

AI Defense is still new. We already have “SI Defense” ready as the next name. :) Just a little naming joke, of course.

Sophos AI Defense identifies supported AI applications, assesses their risks and controls access to them. For this paid add-on, however, the question is: what additional benefit does it offer over the Endpoint and Firewall features customers already pay for?

What is Sophos AI Defense?

AI Defense is configured in Sophos Fusion, formerly Sophos Central. This is the central management platform that many companies still know by its previous name. The add-on brings together information from existing Sophos components such as Endpoint and Firewall.

Its focus is shadow AI: AI applications and agents used outside the intended approval processes. A service can be useful while its terms for handling confidential data remain unclear. AI Defense helps record detected usage, assess applications and enforce access rules.

The Sophos AI Assistant serves a different purpose: it helps administrators with investigations. AI Defense controls access to AI tools.

Endpoint and Firewall can already block AI

Endpoint Application Control can detect and block applications in the Sophos catalogue. It does not automatically cover new tools or custom scripts.

Endpoint Web Control provides custom website lists and, in the newer Web Filtering Profiles, AI web filters too. These profiles require Windows and Sophos Endpoint version 2026.1 or later; other supported devices remain subject to the capabilities and limitations of the classic controls. Blocking a domain does not cover every access route to an AI provider, however.

On the firewall, an Application Filter controls known AI applications through signatures. Our guide to detecting and controlling generative AI explains setup and validation using real requests and logs. Sophos Firewall v23 also offers the Generative AI web category, enforced through a Web Policy. Web categories and application signatures are separate control mechanisms.

Appropriate base licences and configuration are still required. These blocks do not require a separate AI Defense subscription. “It can block ChatGPT” therefore does not justify the extra cost on its own.

What can Sophos AI Defense do today?

Identify applications, users and risks

Sophos AI Defense shows detected AI applications and the associated users or devices.

Sophos names the following tools among others:

This list is not a complete compatibility matrix. Browser, desktop app and API access must each be tested separately: a working browser block says nothing about the other access routes, including different integrations from the same provider.

Inventory, activity views and reports help compare observed usage with approvals, investigate new services and track changes. Completeness depends on sensors and configuration; an empty list does not mean that nobody uses AI. Risk information also does not replace a review of the subscribed plan and its contractual terms. An unapproved app is not, in itself, evidence of data exfiltration either.

Allow, warn or block

Policies determine which applications are allowed, allowed with a warning or blocked. They apply to users, groups or networks and can filter by risk level, for example. Our AI Defense policy guide explains how to build and test them.

A pilot group could use an assessed service while other detected AI apps are blocked. A second group initially receives warnings to assess demand and impact. Warnings allow usage; only an effective block prevents it.

The first active policy with a matching scope applies, followed by the first matching rule within it. If no rule in that policy matches the app, no action is taken; lower policies are still not checked. The activity continues to be recorded. Before a wider rollout, therefore, also test on a test device whether an app without its own allow rule is blocked as intended.

Does AI Defense detect OpenCode with an API key?

This remains unknown: Sophos does not name specific support in the material reviewed, and we have not tested this combination in practice. OpenCode control must therefore not be counted as an existing capability when making a purchasing decision.

OpenCode works with various AI providers and local models. Its provider documentation describes API keys and custom provider endpoints. If the API remains accessible, blocking the chat website is not enough. The key authenticates the user with the provider and, on its own, says nothing about Sophos detection.

Testing must distinguish three outcomes:

• Tool detection: Does OpenCode itself appear, or just a process or network connection?
• Connection control: Does the intended rule detect and block the specific API endpoint with the provider, operating system and sensor in use?
• Prompt inspection: This feature is still classed as a planned enhancement. Detecting or blocking a connection is not content inspection.

The same applies to custom scripts, API gateways and local models: AI Defense is not a promise to detect every model call. For the API test, first make a working call using an approved test account and non-sensitive data, then activate a narrowly scoped blocking rule and repeat the same call. The application, device, sensor, action and policy in the log must match. The test passes only when the rule prevents the previously working call; an invalid key, insufficient credit or a certificate error does not count. Until then, OpenCode coverage remains unknown.

Does AI Defense inspect prompts and purposes of use?

Sophos describes extensive controls for prompts, uploads and AI interactions. At the same time, prompt inspection, differentiation between personal and business accounts, and additional agent protection features are still classed as planned enhancements. The manufacturer’s statements are not entirely consistent here; a purchasing decision should therefore be based on the capabilities reliably available today.

Review status, 26 October 2026: prompt inspection is still classed as a planned feature, rather than a confirmed current capability. A rule that selectively blocks customer numbers or source code within an allowed chat cannot therefore be relied on when planning. Anyone who needs this content control should not buy AI Defense for that purpose today.

I would only buy features that are available and verified today; roadmap features can be delayed or dropped altogether. The still missing mobile ZTNA agent, currently available only for Windows and macOS, and announced Synchronized Security extensions are reasons for caution here.

Email corrections allowed, other tasks forbidden?

No, the current app access rules cannot enforce this distinction. If ChatGPT is allowed, it remains accessible when someone uses it to analyse customer data or contracts rather than correct emails, contrary to company policy.

Even future prompt inspection will not automatically solve this: detecting sensitive data and assessing a business purpose are different tasks. An email submitted for spelling corrections can already contain confidential information. Company policy must therefore specify which content may be entered into which service; today’s app rules do not check compliance with these restrictions on purpose.

What are the prerequisites?

AI Defense is an add-on for eligible EDR, XDR and MDR customers. Sophos also requires EDR Endpoint Protection; a firewall alone or Endpoint without EDR is not sufficient. The Sophos Fusion account must have been migrated to the new platform with Security Operations. The product name does not confirm this technical upgrade; the Fusion check helps before ordering.

The setup wizard offers Endpoint, Firewall and Linux Server as sensors. Endpoint requires Data Lake uploads, HTTPS decryption, QUIC blocking and appropriate Web Control and Application Control settings, among other things. For enforcement rules, the firewall must be under group management and log activity in the relevant Web Policies. Our onboarding guide explains the steps. Existing rules and exceptions must be reviewed, and changes tested with a limited group first.

What does Sophos AI Defense cost?

The non-binding indicative price is around EUR 60 excluding VAT per user or server per year, on top of the existing security licence. This works out at around EUR 5 per month; it is not a monthly billing offer. Volume tiers, term and contract determine the actual price; use requires an active AI Defense licence or trial.

Renewal is also part of ongoing operation: after licence expiration, Sophos disables active AI Defense policies. Renewing the licence does not automatically reactivate them. The KB guide explains the checks and deliberate resumption of operation, so that a paid add-on is not left running with its rules still disabled.

What additional benefit are you actually paying for?

Today’s additional benefit lies primarily in the consolidated AI overview with risk information, reports and policy management designed around it. Without it, IT must combine Endpoint and Firewall information itself, assess services and maintain rules in each product. Across many teams with changing tools, AI Defense can save work here.

The existing products also provide logs, application information and central policies, however. Another dashboard alone does not justify thousands of extra euros annually. The pilot must demonstrate which relevant activities are detected in addition, which rules are enforced more reliably and how much administrative work is saved.

Remembering the MDR Integration Packs

Based on our experience to date, I remain sceptical about add-on modules. Licensing models change too: in October 2025, Sophos announced the removal of Integration Packs, incorporating them into MDR and XDR without an additional integration charge from 1 November 2025 for term licences and the end of January 2026 for MSP Flex.

That was a licensing change and says nothing about any future free AI Defense features. Nevertheless, the question remains why AI control is not part of the ongoing development of Endpoint, XDR or MDR services that customers already pay for. Sophos decides how to divide its products; customers must weigh today’s additional benefit against the extra cost.

When would I recommend AI Defense?

If a suitable Sophos environment is in place and IT needs a shared overview of AI usage across teams, a pilot is worthwhile. The inventory provides a basis for approving services with business departments and agreeing effective rules. Blanket bans without an approved alternative can disrupt important workflows.

If this would first require restructuring the security architecture, existing endpoint, browser and network controls should be considered alongside it. The current AI Defense does not provide prompt inspection or purpose restrictions within allowed chats; OpenCode and API control must be tested separately.

What matters is whether the required services are detected, rules are reliably enforced and work or risks are actually reduced compared with the existing setup. If the pilot only delivers a block that works just as well with features already paid for, it would not be worth the extra cost to me.

Frequently asked questions about Sophos AI Defense