Sophos is extending agentic AI beyond security operations into cyber governance, launching a service that assesses controls, maps compliance requirements, prioritises weaknesses, and prepares management reporting for organisations that may not employ a dedicated security executive.

Oxford-headquartered Sophos made CISO Advantage generally available on 1 October after introducing it in July. The service runs through the company’s Fusion platform and can be bought directly or supplied by managed service providers as part of a wider security advisory offering.

AI is used to gather and analyse assessment information, compare controls with frameworks, identify gaps, and prepare recommendations. Human judgement remains necessary where the output turns into strategy, budgets, or decisions about which risks an organisation will accept.

The product applies automation to a less visible part of security than malware detection or alert triage. It is concerned with the evidence an organisation uses to decide whether controls are working and where limited security spending should be directed next.

Managed providers are moving into security leadership

Smaller and mid-sized organisations often outsource substantial parts of their technology environment, leaving the same managed providers increasingly involved in security policy, compliance, incident preparation, and risk assessment. Sophos is packaging that work into a repeatable service rather than leaving strategic advice as an informal extension of technical support.

Its own September survey found that managed service providers believed an average of 46% of their customers already relied on them for CISO-style leadership, while 84% expected demand to increase over the following year. The figures are vendor research, but they reflect the commercial pressure behind the product.

CISO Advantage provides a system for establishing a baseline, mapping evidence against recognised frameworks, preparing an action plan, and reporting progress. Direct customers can buy an annual licence, while managed providers can deliver it through Sophos’s monthly MSP model.

Outsourcing can give an organisation access to structured security management without recruiting a full-time executive, although it also concentrates more influence with suppliers. A provider that operates controls, assesses their effectiveness, recommends improvements, and reports the results needs governance around how those judgements are produced.

AI adds another layer because a prioritisation system can influence where money is spent even if a person formally approves the decision. Asset data, framework mappings, integration quality, and risk assumptions therefore matter as much as the presentation of the resulting score.

Continuous assessment replaces the annual snapshot

Sophos has spent 2026 expanding Fusion as a data layer across its own products and third-party integrations. CISO Advantage uses that information to connect assessment work with operational evidence rather than relying entirely on questionnaires and periodic consulting exercises.

Security governance does not reduce neatly to technical optimisation. An organisation may knowingly accept a weakness because remediation would interrupt a critical service, cost more than the risk justifies, or conflict with another operational requirement. Conversely, a control that appears compliant in documentation may perform poorly during a real incident.

Sophos intends the service to maintain a prioritised roadmap rather than produce a static annual report. A further CISO Advantage Plus version is planned for 2027 with continuous assurance, governance, and automated compliance features.

The direction mirrors the operating model already common in threat monitoring because cloud estates, suppliers, identities, regulation, and software change throughout the year. A security assessment completed once every 12 months can be overtaken by changes long before the next cycle begins.

Boards, insurers, and regulators are also asking for better evidence behind claims of resilience, increasing pressure on technical teams to translate controls into measures that can be understood outside security departments. Automation can reduce the work involved in gathering that information, but an automated score is useful only when decision makers understand what it measures and what it omits.

Agentic AI is consequently moving above the security operations centre into decisions about risk and investment. Whether that improves security will depend less on how quickly the platform generates an assessment than on the evidence feeding it and whether organisations act on the weaknesses it exposes.