Security2 publishers2 min readPublished
Sophos starts selling an agentic AI service that ranks and prices security fixes for boards
Sophos made CISO Advantage generally available, an agentic AI service that turns a security assessment into a ranked, costed fix list for leadership to fund. The pitch puts a vendor-ranked spending plan in front of boards, either directly or through MSPs that already act as a customer's stand-in security chief.
The Watch · Security desk
What happened
- The service maps an organization's controls against NIST CSF, CIS v8, Cyber Essentials Plus and NCSC CAF.
- Sophos says its assessments draw on live threat intelligence and on data from more than 625,000 organizations it defends.
- Customers can buy it on an annual term license, and MSPs can take it as a monthly subscription through Sophos MSP Flex.
- Sophos's own 2026 MSP survey found 46% of customers look to their MSP to act as CISO, and 84% of MSPs expect that demand to grow over the next year.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision The fix list a board funds is ranked inside the platform of the vendor supplying the defenses, so buyers have to weigh a supplier's ordering of their next security spend.
- capability Organizations with no security lead can stand up a framework-mapped program with board reporting without hiring one, according to Sophos.
- exposure A framework-mapped record of an organization's open control gaps will sit in a vendor system of record, and with a partner as well in fully managed deals.
CISO Advantage is a planning product. It assesses an environment and reports risk and progress in "plain language that business leaders can understand, fund, and act on," in Sophos's words [2]. None of that changes what an attacker can do this week [2]. The general-availability post promises evidence that "holds up with a board, an auditor, or an insurer" [4]. Sophos first introduced the product in July [8].
Sophos says the agentic AI builds its plans "at a speed and scale that human experts alone cannot reach" [20]. The same company describes the Sophos Fusion platform underneath as "powered by agentic AI, with human judgment" [22].
Sophos supplies the figures behind the case for buying. Its release cites a 2026 CISO Report estimate of 35,000 CISOs serving 359 million businesses [13]. That works out to about 10,260 businesses per CISO [1]. The release puts average CISO tenure at 18 to 26 months and says 75% are considering a job change [14]. The general-availability post adds that 79% of organizations struggle to keep pace with compliance requirements, and that IT and security teams spend 39% of their time on compliance work [15]. Help Net Security's article carries the release in Sophos's first person, down to "our 2026 MSP Perspectives Report" [16].
Rob Harrison, Sophos's SVP of product management, aimed the launch at the board. "We built it around the question every board is now asking its security team: are we safer than we were last quarter, and can you prove it?" he said [17]. He said good security strategy has "stayed a luxury only the largest enterprises could afford" [18].
The ranking is produced inside Sophos's own platform. Sophos Fusion, which delivers the service, connects more than 500 Sophos and third-party integrations, according to Sophos [7]. The company selling the defenses also writes the ranked list a board is asked to fund [5][22]. Sophos did not publish prices, and neither announcement says whether a roadmap will ever rank a rival's product as the fix [9].
For MSPs, the release says, the product turns the stand-in security role into "a structured, scalable, and billable service" [19]. Both sources trace back to Sophos, so the evidence covers one vendor's product [8][16].
What to watch
- Delivery of CISO Advantage Plus, due next year with continuous assurance and live measurement of control effectiveness.
- First accounts from MSPs billing customers for the service, the earliest evidence beyond Sophos's own surveys that the stand-in CISO model sells.
- Any side-by-side test of an AI-built roadmap against a human-led assessment of the same environment.