Analyst(s): Fernando Montenegro
Publication Date: October 5, 2026
Sophos has launched CISO Advantage, an AI-driven cyber program management offering delivered through Sophos Fusion for organizations without a dedicated chief information security officer (CISO), and for the MSPs that often fill that role. The value is a coherent security program, not another tool, and Sophos approaches it from the controls it already runs.
What Is Covered in This Article:
- Coordination is the Value: For small and mid-sized organizations, a coherent program that sequences a limited budget and answers insurers and customers once matters more than adding another tool.
- Built for Organizations without a Security Leader: Sophos CISO Advantage produces framework-mapped assessments, prioritized roadmaps, and board-level reporting inside Sophos Fusion, building on the Arco Cyber acquisition.
- A Channel Play First: The offering turns the informal security leadership MSPs already provide into a billable, recurring service, with remediation work flowing back to the MSP and Sophos, reviving the old auditor-consultant tension.
- Telemetry is the Bet: Live Fusion data could show whether controls behave as expected, not only whether they are configured; how far that reaches in mixed, multi-vendor environments is the main open question.
The News: Sophos CISO Advantage, launched October 1, is an agentic AI-enabled offering for cyber program management delivered through Sophos Fusion. It builds an assessment tailored to an organization’s environment and threat profile. It then maps controls to the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Center for Internet Security (CIS) Controls v8, Cyber Essentials Plus, and the UK National Cyber Security Centre’s Cyber Assessment Framework (NCSC CAF) and produces a prioritized, budget-aligned remediation roadmap.
The first release adds AI-generated scoring and report narratives, multi-audience reporting, industry benchmarking, and evidence storage for audit and cyber insurance requirements.
The offering builds on Sophos’s February 2026 acquisition of Arco Cyber. It is rolling out across North America, the UK, and Europe, sold monthly through MSP Flex or as an annual term license, with global availability expected by year-end. A Plus tier is planned.
Sophos CISO Advantage Targets Organizations Without a CISO
Analyst Take: There is a part of the cybersecurity market that the industry talks about often and designs for less often: small and mid-sized organizations, which answer to the same insurers and auditors as their larger peers. Many sit below what Wendy Nather called the “security poverty line,” not for lack of care, but because the budget, expertise, and buying influence that security offerings assume are concentrated further up the market.
When it bought Arco Cyber in February, Sophos cited an industry estimate that fewer than 32,000 of roughly 359 million organizations worldwide have a CISO (its launch materials now cite a newer estimate of about 35,000). Where a security leader does exist, roughly two-thirds present to their board quarterly or monthly in every size band surveyed, down to 100 employees (Futurum’s 1H2026 Cybersecurity Decision-Makers Survey, N=929), so the expectation does not shrink with company size, only the capacity to meet it.
What organizations without a CISO need is less a title than a coherent program. Their security tends to be added one purchase at a time (some from the MSP, some bundled with the productivity suite, some added because an insurer or a large customer asked). With a budget for perhaps a handful of real projects a year, knowing which ones come first matters more than any individual tool.
A coordinated program brings order to that, answers recurring insurance and customer questions once, and keeps attention on the unglamorous basics (patching, configuration, access, backups) where many incidents start. To us, that coordination is the value on offer and a welcome change in a segment that is mostly product-led.
Many attempts at that structure have come from the governance side, from virtual CISO (vCISO) platforms and compliance automation vendors that mostly check whether controls are configured as intended. Sophos, like several vendors named below, comes from the controls side, already protecting more than 625,000 customer organizations, largely through the channel (MSPs included), and CISO Advantage adds a program layer on top. Folding Arco in within about eight months is quick work.
Who Is Acting as the CISO?
In its own survey of MSPs, Sophos found that providers see many of their customers already looking to them as their CISO, and expect that demand to grow. We hear the same (the provider running the firewall is often the one asked whether the company is “secure enough” before an insurance renewal).
In a channel-led market, the customer has delegated a sizeable share of security judgment to the provider, with this delegation mostly delivered informally as goodwill bundled into a tooling contract. The economics favor formalizing it. CISO-level expertise is a fixed cost few small firms can carry on their own, while an MSP can spread a structured practice across dozens of customers, much as managed detection and response (MDR) did for security operations. We feel Sophos reads that correctly, and its partner messaging is explicit about it (“a service you deliver, not a tool you resell”).
Accountability remains with the customer’s leadership and board, but the evidence they now rely on comes from the provider. If the MSP’s assessment is what the board sees, who checks the MSP?
Can Telemetry Turn Assessment Into Evidence?
The assessments draw on live Fusion data, Sophos says, which in principle lets it check whether a control behaved as expected (hence its description of the output as “evidence, not opinion”).
To us, that targets the right problem, since control existence is not control effectiveness, and boards and insurers increasingly ask about the latter.
Sophos’s blog places continuous monitoring in a planned Plus tier, which the press release positions for enterprise organizations, and the company has not detailed how much third-party data (from a firewall or identity provider it does not run, say) feeds the scoring.
The frameworks also ask for more than any telemetry can show. NIST CSF and the NCSC CAF weigh governance, supplier oversight, incident readiness, and staff awareness as heavily as technical controls, and none of that shows up in endpoint or firewall data. Those parts of an assessment still rest on interviews and documents (reasonable, but the “evidence” label fits some sections better than others).
Pipeline From Inside the Engagement
Sophos tells partners that every gap an assessment surfaces becomes “a pipeline from inside the engagement.” For the customer, that closes a loop many assessment tools leave open, turning findings into remediation in the same platform (framework mapping helps, since an audit with a deadline moves owners, where a probabilistic risk argument does not).
It also revives the old auditor-consultant tension, where whoever scores the program sells what the score recommends. Customers will ask how the roadmap treats controls Sophos does not sell.
A Different Starting Point in a Busy Field
On the governance side, vCISO platforms such as Cynomi, RealCISO, GetCybr, and ScalePad, among others, sell assessments and roadmaps through MSPs, and compliance automation vendors such as Vanta and Drata cover much of the audit-readiness work. Services firms such as SideChannel, GuidePoint Security, and Coalfire, among others, offer the human version, fractional CISOs working for the customer.
Technology vendors such as Barracuda, Coro, WatchGuard, and Huntress sell heavily into the same smaller organizations, as do MSP management platforms such as N-able, Kaseya, and ConnectWise, among others.
Sophos’s edge is one of degree, not kind. It combines Fusion telemetry, an Arco-built program layer, and the incident view from its MDR operation (whose agentic operations data we covered in a prior note), which can help rank which gaps matter most, a combination that others hold in part.
We expect the market to sort out who makes that data credible to those who price risk. Insurers face a textbook information problem with smaller organizations (from the outside, a well-run small company and a lucky one look much the same), which is why underwriting keeps moving toward technical evidence of how controls behave. If Sophos spells out which third-party sources feed the score, and insurers accept the output, the telemetry bet becomes a strong argument in competitive deals.
What to Watch:
- How much of the score comes from telemetry? Buyers should ask which findings are validated against live Fusion data and which rest on questionnaire or interview input, since that split determines how far the “evidence” claim holds.
- Will underwriters accept the output? If cyber insurers treat CISO Advantage reports as technical evidence rather than another attestation, MSP customers gain leverage on premiums and terms; if not, their value rests on program structure and reporting.
- Will the output make sense to an owner? For a small business without security staff, the test is whether the roadmap reads as a short, ordered list of decisions, not a maturity report someone else has to translate.
- Does this change what an MSP is worth? A provider with a billable advisory practice is a different business from one reselling licenses, provided customers pay for guidance they once received informally (Sophos has not published pricing).
- What do the contracts say? When an MSP delivers the program, contracts should specify who validates the findings, what the provider is liable for, and how the customer can independently test the advice.
For more information, read the full announcement from Sophos.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Other Insights From Futurum:
Security Operations Platforms – Futurum Signal
Does Sophos’ Agentic SOC Data Change the MDR Conversation?
A Loud Floor and a Quiet Gap: Security Summer Camp 2026
As Cyber Becomes Strategy, How Must Security Management Evolve? – Report Summary
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
