Sophos CISO Advantage: purpose, service boundaries, and adoption

Sophos CISO Advantage helps turn security risks into a prioritised improvement roadmap and understandable management reports. The offering serves both organisations without a Chief Information Security Officer and existing security teams. It forms part of the Sophos Fusion (formerly Sophos Central) offering and supports security programme planning; it is not an additional endpoint agent or a replacement for incident handling.

Availability, checked on 28 October 2026: Sophos continues to describe a rollout in selected regions. This does not confirm availability in Switzerland, for a particular legal entity, or in every Fusion tenant. Before planning deployment, confirm the country, delivery route, purchasable service, and actual start date. A visible product name or a general announcement is insufficient.

The Fusion tenant’s data region determines technical delivery; the company address and tenant region can differ. Before ordering, reconcile the tenant, region, licence and access route with the partner. For partner-managed use, include the specific customer and estate structure in this check. A general GA announcement does not establish activation for every tenant or management structure. If My Products > CISO Advantage is absent, check these points and the acting account’s role rather than speculatively creating a second tenant.

What the offering does

Sophos describes four connected stages: a baseline assessment using environment data and business context, reports for leadership, a prioritised improvement roadmap, and repeated progress reviews. Mapping to frameworks such as NIST and CIS can help structure the work; it does not certify compliance with a standard or the law.

The practical distinction from an alert overview lies in the decision: which risk affects which business process, which action takes priority, and how can improvement be demonstrated later? A recommendation still needs an internal owner, a budget, and approved implementation.

According to Sophos, CISO Advantage can be used by an internal team or with a service partner. This does not automatically include a personal CISO engagement, transfer leadership accountability, or provide unlimited consulting. The actual assistance belongs in the specific agreement.

Distinguish it from related services

Account Health Check checks specific Sophos protection and tenant settings. CISO Advantage addresses the wider assessment and prioritisation of the security programme. A good health indicator does not replace that assessment.

MDR and MDR Plus concern monitoring and response to active threats. Managed Risk examines the agreed attack surface for vulnerabilities. A strategic report does not automatically activate or deliver these services. Likewise, a Security Services Retainer is a separate procurement model with individually scoped assignments.

Reconcile licensing and scope beforehand

Sophos offers an annual Term licence for use within the organisation or with a service partner, and a monthly subscription through MSP Flex. The public GA announcement describes these models. The platform alone does not include the product or personal consulting hours.

The models use different quantity units. In the public MSP Summit, Sophos explains Term on a per-user basis and MSP Flex per managed customer, with one monthly licence regardless of the organisation’s size. The general licensing policy dated 16 October 2026 lists CISO Advantage as a subscription per user, without explaining this Flex distinction. Record the specific model in the quotation and License Schedule accordingly. A Term quotation is not calculated using the number of customer tenants; for Flex, user count and the monthly customer unit must not be mixed. Describe any separately agreed consulting independently. The general licence checks in Sophos Fusion do not replace this product-specific review.

What to record yourself and how AI helps

The current process starts with an organisation profile and a questionnaire. Owners describe and assess the state of security controls and attach supporting evidence. CISO Advantage does not currently collect evidence automatically from Sophos or third-party products. An existing Fusion product and its telemetry therefore replace neither answers nor evidence. The Sophos usage overview explicitly lists the profile, completed assessment, evidence and targets as steps in the process.

AI can explain a control and prepare wording or assessments. Under Analyze conversation, an approved VTT transcript of a conversation can be analysed against an assessment. Select the whole framework, particular sections or individual questions, confirm the required participant consent and start Analyze. Under Review changes, review the suggestions; scores, notes or both can be selectively accepted and edited beforehand. This is assisted analysis of information provided, not an autonomously performed security audit. The documented process explicitly requires human review.

The GA announcement describes CISO Advantage Plus, with continuous assurance, governance extensions and automated compliance, for 2027. This establishes neither a binding delivery date nor automatic control validation available today. Acceptance depends on the features actually delivered and the results verified.

From profile to published assessment

An assessment is a structured evaluation against a selected framework. Before starting, define ownership, the organisation in scope and the assessment period. An approved framework with a few well-understood controls makes a manageable pilot. There is no need to deliberately weaken a production configuration for this.

Define the profile and scoring model

Under My Products > CISO Advantage, the wizard guides you through the organisation profile. Organizational context describes items such as industry, employee count and revenue. Additional context adds business objectives, risk history and IT dependency. Record unknown values as unknown; invented precision would also distort modelled impacts. Both profile parts must be complete for subsequent reports. An existing profile can be updated under Assessments > Update profile.

Choose the framework according to the actual assessment objective. The framework help distinguishes three models:

Check the precise version and available selection in the tenant before starting, for example for CIS v8, NIST CSF 2.0 or NIS2. If a particular framework such as AIUC-1 is a contractual requirement, confirm its availability beforehand. ISO-Aligned Assessment is not ISO certification; Cyber Essentials is not a promise of Cyber Essentials Plus certification. Scores from different models cannot be compared as though they were identical percentages.

Answer controls and set targets

The assessment process is documented as follows:

1. Open Assessments > Create Assessment. Set Framework, a unique Label and Period start, for example October 2026 baseline assessment with the actual start of the assessment. The name is freely chosen. Create it with Create Assessment.
2. Expand a section and open a control. Under Overview, record the actual Deployment status and, where required, Remediation. For maturity-based frameworks, select the maturity level supported by evidence.
3. Under Overview, Owner and Target Date specify who will work on the improvement and by when. Explain implementation and known gaps under Additional information. Answers are saved automatically.
4. Set targets for each Framework under CISO Advantage > Targets, apply them with Apply and save with Save. Different values for an individual assessment can be set on its Targets tab.

A target must fit the risk, budget and schedule. Not every control immediately needs the highest maturity level. The Targets help also describes section-specific differences and priorities by Implementation Groups. N/A removes a control from score calculation; this choice therefore needs a justified scope decision and must not be used merely to improve the displayed value.

Assign evidence and record the result

Evidence should support the specific answer, for example a sanitised configuration record or a report of a recovery test actually performed. Check access, confidentiality and permitted content before uploading. Passwords, tokens and unnecessary personal data do not belong in the file.

Under My Products > CISO Advantage > Evidence > Add evidence, give the evidence a name and description and add the file under Attachments. Use Add controls to select the assessment and associated controls, then choose Submit evidence. Existing evidence can later be assigned to further controls through Actions > Assign to controls. Alternatively, add it within the assessment or directly on a control’s Evidence tab. The evidence help explains these routes.

After assigning evidence, reopen the same control: do the file, description, date and actual implementation support the answer? An old screenshot or a merely planned test is not sufficient current evidence of effectiveness. Under the assessment’s Findings, check outstanding answers, target achievement and available comparisons. Publish the assessment only after reviewing answers, evidence and targets. Only one draft per framework can exist at a time, so coordinate a new assessment with the existing work in progress.

Create a report and review its substance

The report help requires both profile parts and at least one published assessment. If either is missing, CISO Advantage prompts for completion.

1. Open CISO Advantage > Reporting > Create report.
2. Select the required assessment, enter the assessment owner’s name and complete the wizard.
3. In the customisation view, hide unsuitable sections and review or edit AI-generated text. Impacts and priorities matter to leadership; IT also needs specific gaps and implementation steps.
4. Save with Save report and generate the file through Render PDF. Before sharing, check recipients, period, scope and the security information included.

Modelled financial impacts are estimates based on the inputs, not guaranteed loss amounts. An industry comparison is meaningful only when suitable comparison data is available. Review the proposed roadmap against risk, dependencies, effort and available owners; automatically generated wording does not replace that decision.

For progress reviews, reassess later using comparable scope and the same framework. In the report and under Findings, reconcile differences with the actions actually implemented. A higher score without new evidence does not demonstrate technical improvement. If the report is missing, first check profile completeness and whether the assessment has been published. If expected progress is missing, compare the period, framework, targets and new evidence before changing answers solely to improve the metric.

Prepare a useful starting point

The following preparation is an Avanet recommendation, not a documented click path:

1. Define the decision. For example, the next budget round should justify the three most important security improvements for a critical business process. Name the review period and responsible leadership.
2. Record the baseline. Gather critical services, existing protection products, known risks, owners, and planned actions. Explicitly flag missing or outdated data.
3. Scope the agreement. Confirm country availability, licence quantity, term, internal or partner-led use, expected reports, and any consulting. Also define data access, recipients, and report retention.
4. Make results verifiable. For each prioritised action, agree on the risk, affected process, owner, deadline, effort, and observable target state. An AI summary alone is not evidence.
5. Plan the follow-up. Reassess the same scope and criteria at the agreed time. Technical changes are approved and verified through the relevant product runbook.

If country availability, the data baseline, or a clear deliverable is missing, commissioning remains pending. For an active attack, use the agreed incident process; a strategic assessment is not an emergency response route.