Sophos, a cybersecurity company, has launched Sophos AI Defense to help businesses find unapproved AI tools and check whether employees or applications are sending sensitive data to them.
Now generally available, the product monitors AI activity across devices, networks, sign-ins, and browsers. It checks prompts, file uploads, and other AI interactions in real time to help security teams enforce company rules on AI use.
“Organizations are adopting AI faster than they can secure it, and most security teams can’t answer three basic questions: which AI tools are running, what data is going into them, and whether that activity lines up with policy,” said Kyle Falkenhagen, senior vice president of product management, Sophos. “Sophos AI Defense gives security teams that visibility and the control to act on it, so they can say yes to AI and know exactly what they’re saying yes to.”
The product addresses shadow AI, or AI tools and agents used without a security team’s approval. These tools can create gaps in a company’s defenses and give sensitive business data another route out of its systems.
Sophos cited figures showing that 69% of organizations suspect or have evidence of employees using unapproved AI agents and tools. It also cited findings that 82% discovered shadow AI agents in their environments in the past year, while 90% of IT leaders were concerned about shadow AI risks.
Sophos AI Defense maps AI activity and assesses who is using a tool, how they are using it, and what data is involved. This helps security teams distinguish routine work from activity that needs attention.
The product is delivered through Sophos Fusion, the AI-native cybersecurity defense system. AI activity is fed into that system so teams using Sophos XDR, along with Sophos MDR analysts, can investigate and respond through their existing processes.
The launch also comes as attackers use AI in their own operations. Sophos X-Ops tracked an attacker using AI agents inside a customer’s network to build and test nearly 80 malware modules. It also observed criminals selling access keys to advanced AI models, sharing techniques to bypass AI safeguards, and recruiting AI prompt engineers.
The integration allows security teams with limited resources to activate AI security through Sophos Fusion. Managed service providers (MSPs) can also offer the capability to their customers.