CISO-led advisory services will become partners' biggest opportunity in next 12-18 months: Sophos

With the launch of Sophos Fusion, the company says partners must move beyond selling security products and position themselves as strategic advisors focused on compliance, risk and business outcomes.

Sophos believes CISO-led advisory services will emerge as the biggest growth opportunity for its partner ecosystem over the next 12 to 18 months as organisations seek guidance on risk, compliance and cyber resilience alongside technology deployments.

The focus on advisory-led services comes as Sophos launches Sophos Fusion, an AI-native cybersecurity defence system that combines endpoint, network, identity, email, cloud security and security operations into a unified platform.

Speaking to CRN India, Sophos president Raja Patel said Sophos CISO Advantage is expected to create the largest opportunity for partners as it shifts customer conversations from reactive security spending to proactive risk management.

“We believe that CISO Advantage will be the biggest opportunity for our partner ecosystem,” Patel said.

“What it really does is it takes our partner ecosystem and puts them as the strategic partners for those businesses where they may or may not have a CISO today.”

According to Patel, partners will be able to help customers understand how they compare against regulatory requirements, identify security gaps, benchmark themselves against peer organisations and recommend the right solutions to address those gaps.

“By doing so, we start shifting the conversation from reactive to proactive,” Patel said.

“It is probably fundamentally the largest opportunity for our partner ecosystem over the 12 to 18 month period.”

The opportunity is being driven by a broader shortage of security leadership across organisations.

Sophos CEO Joe Levy said there are approximately 359 million organisations globally but fewer than 35,000 CISOs, leaving many businesses without dedicated security leadership.

According to Levy, the gap creates an opportunity for partners to provide strategic security guidance and help customers make informed risk and compliance decisions.

Moving beyond product sales

Sophos also believes partners will need to rethink how they engage customers as AI continues to reshape cybersecurity.

Responding to a question from CRN India on what partners should stop selling or doing to remain relevant in an AI-driven security landscape, Sophos senior vice president, product management, Rob Harrison, said partners need to move beyond product-led conversations.

“The opportunity in front of partners is not simply to sell security technology,” Harrison said.

“It is to help customers navigate a rapidly changing security landscape and deliver outcomes they often cannot achieve on their own.”

According to Harrison, AI is accelerating threats while increasing operational complexity, creating demand for partners that can act as trusted advisors rather than technology resellers.

“The partners that will win are those that move beyond individual products and become trusted security advisors,” Harrison said.

“That means leading with risk reduction, resilience, operational outcomes, compliance, and business value rather than feature comparisons.”

Sophos launches Fusion

The comments come as Sophos launches Sophos Fusion, which the company describes as an AI-native cybersecurity defence system designed to bring together security operations, endpoint, identity, network, cloud and email protection under a single architecture.

The company said organisations today are relying on a fragmented security environment.

According to Sophos, the average enterprise operates over 45 security tools, while the average security operations centre manages nearly 11 security consoles.

Sophos argues that while organisations continue to spend heavily on cybersecurity, the growing number of tools has created operational complexity without necessarily improving outcomes.

Fusion will help address that challenge by combining endpoint protection, endpoint detection and response (EDR), extended detection and response (XDR), next-generation SIEM, identity threat detection and response (ITDR), managed detection and response (MDR), network security, email security, cloud security and advisory services into a single defence system.

The platform is built on Sophos Central and incorporates Secureworks Taegis analytics following Sophos' acquisition of Secureworks.

Levy described Fusion as the completion of Sophos' Secureworks integration strategy.

“We didn’t acquire Secureworks to add another product to the shelf,” Levy said during the company's media briefing.

“We acquired them to bring two leaders and two leading architectures together.”

According to Sophos, the platform combines the depth of Secureworks Taegis analytics with the reach of Sophos Central into a unified system rather than separate connected products.

Sophos launched Fusion against a backdrop of evolving cyber threats driven by AI. The company said attackers are using AI to accelerate existing attack techniques and compress attack timelines.

According to Sophos threat intelligence expert Rafe Pilling, activities that previously took attackers days or weeks can now be executed in hours.

Pilling also said the majority of ransomware attacks now begin through identity-based compromise rather than technology-based exploits.

“The cybercrime landscape and underground forums are awash with stolen credentials,” Pilling said.

He added that organisations are seeing increasing use of compromised credentials across endpoint and cloud environments, allowing attackers to move quickly and at scale.

Sophos believes these changes require a coordinated approach to defence.

The company said Fusion is built around four core principles: a shared context layer that aggregates security data, synchronised security across control points, agentic autonomy with human oversight, and intelligence that improves as more organisations contribute threat data.

Expanding the Fusion platform

Sophos is expanding the Fusion platform with several new capabilities scheduled for release between August and October 2026.

Sophos MDR is being enhanced with continuous AI-enabled threat hunting powered by Sophos X-Ops threat intelligence and broader response capabilities across endpoint, firewall, email, cloud and identity environments.

According to Sophos, the MDR platform now supports over 40,000 customers globally.

The company said 52 percent of cases are currently handled through agentic workflows and the average time from alert to automated response is 89 seconds.

Sophos is also rebuilding its XDR platform using Secureworks Taegis analytics, adding thousands of new detection capabilities, built-in SOAR automation and a new analyst experience.

Other additions include a next-generation SIEM platform, Sophos AI Defence for managing AI-related risks and shadow AI, and Sophos CISO Advantage.

Available from October 2026, CISO Advantage will provide continuous risk assessments, compliance mapping, peer benchmarking and security guidance through Sophos' MSP ecosystem.

For Sophos, however, the bigger opportunity extends beyond the technology itself. The company expects partners to differentiate through advisory services, compliance expertise and business-focused security outcomes rather than standalone product sales.