Sophos brings shadow AI monitoring into its security platform

The newly available AI Defense tool is designed to reveal unauthorised AI use and help security teams control sensitive data shared with AI tools.

Sophos has made its AI Defense product generally available, pitching it as a way for security teams to identify unapproved AI tools and monitor whether staff or applications are feeding sensitive information into them. The company says the software is designed to give organisations a clearer view of AI activity across devices, networks, sign-ins and browsers, while also applying real-time controls to prompts, file uploads and other interactions. According to Sophos, the aim is to help companies establish and enforce rules for AI use without blocking legitimate work. Sophos says in its announcement that the product is built to surface what it describes as shadow AI: tools and agents adopted without the knowledge or approval of security teams. ^[2][7]

Kyle Falkenhagen, senior vice-president of product management at Sophos, said organisations are embracing AI more quickly than they can secure it, and argued that many security teams cannot answer three basic questions: which tools are in use, what data is being sent to them and whether that activity matches policy. Sophos says AI Defense is meant to provide that visibility and enough control for teams to approve AI use with greater confidence. The service also classifies activity by who is using a tool, how it is being used and what data is involved, so that security staff can separate routine use from behaviour that may warrant intervention. ^[2][7]

The launch comes against a backdrop of widening concern about unauthorised AI use in workplaces. Sophos said 69% of organisations suspect or have evidence that employees are using unapproved AI agents and tools, while 82% have discovered shadow AI agents in their environments over the past year and 90% of IT leaders are worried about the risks. Those figures are echoed by other industry research: the Cloud Security Alliance reported in 2026 that 82% of organisations had found previously unknown AI agents in the previous year, and Komprise said 90% of respondents to its 2025 survey were concerned about shadow AI from a privacy and security standpoint. ^[2][4][5]

Sophos is also framing the product as part of a broader threat landscape in which criminals are using AI for their own purposes. The company’s X-Ops team has tracked an attacker using AI agents inside a customer network to build and test nearly 80 malware modules, while also observing criminals trading access keys to advanced AI models, swapping methods for bypassing AI safeguards and seeking out prompt engineers. In a separate technical write-up, Sophos said the evidence showed AI-assisted development and testing, but not the near-total bypass success claimed by the threat actor. ^[2][3][6]

The new capability is delivered through Sophos Fusion, the company’s AI-native defence platform, and feeds into existing Sophos XDR and MDR workflows so that teams can investigate and respond without adding a separate security stack. Sophos says that approach is intended to suit organisations with limited internal resources, and that managed service providers can also offer the feature to customers. In effect, the company is trying to fold AI governance into mainstream security operations rather than treat it as a stand-alone problem. ^[2][7]

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

Source: Fuse Wire Services