Name: Sophos MSP Summit: Securing the AI Era
Uploaded: 2026-10-08T12:16:15.653Z
Duration: 2 h 53 min 40 s
Description: Sophos MSP Summit: Securing the AI Era

Transcript for "Sophos MSP Summit: Securing the AI Era": AI accelerated threats don't see your defenses the way you do. They see the gaps. That's where they thrive. The answer is not a platform. It's not a stack. Sophos built something smarter, a cyber defense system. Every control point, every service, every data source, every analyst connected, responding as one. A single open architecture, pulling your entire environment into one coordinated defense, always learning, always adapting. Every threat stopped, every edge case solved across more than 625,000 organizations raises protection for all. AgenTic AI at speed, human accountability in command. The gaps are gone. The Sophos AI native cybersecurity defense system. Sophos Fusion, securing the AI era. Hello, everybody, and welcome to the Sophos MSP Summit, securing the AI era. I'm Naveed Malik, and I'm delighted to be your host today. One topic that's dominated every conversation I've had with MSPs in recent months has been AI as I'm sure it has been with yourselves. And that's what we're here to talk about today, how you can grow your security practice in the AI era, how you can take advantage of the growing demand for AI related solutions to win new customers, expand your footprint with existing customers, elevate your trusted adviser status, and strengthen and deepen your customer relationships. We've got a great agenda for you today that looks at AI from all different security angles through the lens of an MSP. We've got people from many different time zones here. So rather than putting exact timings on the agenda, we've got session slots. We're also very mindful that you have businesses to run as well. So we've deliberately orchestrated the agenda. So if you need to step out and answer an email, make a call, you can do. The event will continue, and you can step in and out as you need to to make it as convenient as possible for you to take on as much as you can today. The first hour will focus on two areas. We'll set the scene with a look at what the AI era means overall for MSPs and also how to build the MSP practice for the AI era. As part of this session, we're gonna be looking at Sophos Fusion and Sophos AI Defense. Then we're gonna take a break from presentations to take a q and a and look at the poll results. And an advanced warning here for all of you, we're gonna be asking for your input. Please make sure you take the time to, contribute and get involved in the q and a. The second hour looks at how you move from being a security provider to a strategic partner. Here, we'll explore exactly how you can provide the strategic governance that... And the technology leadership needed in the AI era. And, again, we'll then take time for questions and poll results. And then finally, in the third hour, when we bring it all together, showing the AI era MSP experience in action, sharing the perspectives of real Sophos MSP partners from around the globe and bringing it all together with a clear strategy for you to take away. Content from today's event will be available to you on the partner portal. So all the items that we reference, the resources that you need to help you through your journey, and then we'll also be making an edited version of this event available on demand afterwards. So if there are any elements that you do miss, then please feel free to catch up afterwards. If you want to learn any more at any point, click on the request a callback button at the top of the screen, and we'll let your team know that you want to speak to them. We've also got a q and a function, as I mentioned previously. So if you do have any questions, please submit them as we go along in real time. If we don't get a chance to answer them live, we will follow-up with you afterwards. Most of you will already be familiar with Sophos, but some of you may not be so familiar with the way or how we support MSPs. Sophos is the leading provider of cybersecurity solutions in the MSP space. We're trusted by over seven and a half thousand active MSP partners, supporting more than 275,000 customers worldwide. Overall, as you've likely heard, Sophos defends more than 625,000 organizations globally. More than a quarter of a million a million of them are through our MSP network. This gives us unmatched insights into the threats and security challenges facing MSP clients. It also delivers unmatched community immunity, whereby we stop a threat in one customer environment. We automatically elevate protection for all 275,000 plus Sophos defenses, which are backed and by unmatched telemetry and threat intelligence powered by an elite global security operations team, a true follow the sun model of expert analysts, threat hunters, adversary trackers, and more. Sophos is validated by leading independent testing organizations and consistently ranks among the top cybersecurity vendors recognized for our protection, performance, and innovation. This third party validation gives MSP the confidence to trust Sophos with their customers and their business. We also give you the most comprehensive portfolio on the market. We offer the broadest range of native control points, prevention and control... Prevention and controls across endpoint, firewall, email, identity, cloud, and AI, security operations from EDR and XDR through to SIEM, ITDR, and NDR, managed detection and response, security testing and assessment services, and Sophos x ops threat intelligence all working together. No other vendor gives you this breadth and this depth of coverage. And while Sophos solutions provide the strongest line of defense, we are also open working with the technologies your customers already use. So now you've got a good understanding of Sophos and our commitment to the MSP community, let me turn over to our first speaker, Chris Bell, senior vice president of channels at Sophos. Welcome to the Sophos MSP Summit. For those of you that don't know me, I'm Chris Bell. I'm SVP of global channels at Sophos. I started here about a year and a half ago, and I came in via the Securus acquisition where I was a chief strategy officer. What I've been spending time over the past year and a half is really spending time with thousands of MSPs. And what I've learned about MSPs, one, you're builders. You build trust. You build businesses. You build practices. And And I also know that customers look to you first to help navigate change. And we are in a... Not only a market, but we're in a era of constant change. And what I have also found is MSPs are uniquely qualified to lead. If there's one thing that I think will be critical in this era and that specifically the AI era, it's leadership, and that's who's gonna win. Those that are uniquely qualified to lead in a in a market of constant and evolving change. This summit's called securing the AI era. And there's really three fundamental questions that most partners are asking me too. One is how do... How can I make more money? Right? Ultimately, it comes down to revenue. The second question is how can I save money? Think EBITDA. But where we're gonna spend the majority of our time today is how can I reduce risk? And that's the third question that's being asked often. And if I really do the double click around these questions, and specifically around risk is, how does AI impact cybersecurity? The reason I'm asked this question and almost every conversation I'm in is because of the headlines. If you think about the headlines, on one side, we get, we're doomed. Right? We're doomed based on the latest AI threats and the speed of the threat landscape and how that's evolving and changing. But in that very same conversation or the very next morning, we get the say... We get a very different headline that will come across as, it's a miracle of everything we can do with AI. Just think if we can harness the power of AI for the good, how far we're gonna be as a society? The second question we get is how can we manage and reduce our cyber risk? Right? And what most organizations say is, I don't even understand how my employee base is using AI, how much they're using it, what tools that they're using. So if I don't have the right visibility, then, ultimately, how can I secure and govern it? That's an... That's a question we'll help you through today. The third question that we often get is, how do we take advantage of AI without exposing the company to security risks? Every CEO is ultimately asking each one of us on how can we use AI to also be more effective in our job. So we're all doing just that. But as we're using more and more AI, ultimately, that can create more and more risks. So how can we make sure to both harness that risk, but make sure that we can take that risk, and put it in the right landscape? And then the fourth question, as you can just understand by these three questions, it's a complicated topic. So where do we even start? So the goal today is how can we help you guide your clients through this AI confusion, and how can you become the MSP leader for the AI era? I was recently with our CEO, and he was on a panel. And someone asked him the question, what's the closest comparison you have seen to the AI era? And very quickly, he said the industrial revolution. The industrial revolution transformed society. He's much more so a history buff than I am, but so then I had to go and do my own history lesson, and he was spot on. If you look at what historians have said, is the industrial revolution was the most material advancement to society ever. And what we're hearing from historians today is the AI era is gonna be significantly bigger than that. Right? If you just think about the models that occurred in November, right, those frontier models that seem to happen overnight, in November, it felt like that was a error level of transformation. And we've had many more errors since November. You could... So you could just imagine how fast we're gonna go. And you should not be surprised that our customers feel overwhelmed. Right? They're overwhelmed with the pace of change. But with them being feeling overwhelmed, this is our opportunity to ultimately guide and lead, and we're gonna do just that. Taking on a slight second history lesson, and if you look at photographs or portraits from orchestras from hundreds of years ago, you may notice one thing. There was no conductor. There was a choir master. There was musicians. There was a choir, and there was a lead violinist. And that lead violinist was ultimately... They were playing that player coach role. Right? And everyone followed their lead. But over time, that orchestra became more complex. The music became more complex. We added instruments like the tuba, and many more instruments. So then there became a need for someone ultimately to lead these orchestras, many of which that are 40 plus piece orchestras, and say, how can I take noise from 40 musicians and make it feel like one performance? You can probably imagine the parallels I'm making here. But in the era that we're in, we're in a a area of a lot of noise, lots of risk, lots of confusion. And what matters here is we need leadership. Right? We need a conductor. What I firmly believe is MSPs are gonna be the conductor in this era. Right? And what we're gonna spend time today and focus most of the time is how can you be the conductor in this AI MSP era? This is an opportunity for you to learn. It's an opportunity, for us to learn from you hearing about what you're dealing with on a daily basis, what your customers are saying. And with the power of you and what you're hearing from your customers and what we know about this AI landscape, we're gonna be well equipped to make sure that you're in the best place to guide your customers. So with that, I'm gonna pass the baton over to the team. Hello, everyone. Welcome. I'm Sally Adam, vice president of product marketing at Sophos, and I'm joined by Ed Martin, AI leader and vice president of AI product management. It's a privilege to be with you today. Thank you for taking the time. Chris talked about how AI is likely to bring a level of societal change on par with the industrial revolution. And here, in 2026, we're just at the start. We're witnesses to the birth of a new era. And in this new era, cybersecurity is at the front line of innovation. All of us who work in cybersecurity, we're leading from the front when it comes to adapting to, responding to, evolving to AI. In this session, Ed and I are going to look at how to build the MSP practice for the AI era. And to do that, I'd like to start by answering one of those questions that Chris raised. How does AI impact cybersecurity? The security environment has changed dramatically in the last year. Advances in AI have increased the speed, the scale, the scope of attacks beyond what was even imaginable a few years ago. Attacks are executing at machine speed, not human speed, and AI exponentially increases the volume of attacks while lowering the barrier to entry for adversaries. AI has also enabled attackers to increase the complexity of their attacks. Those sophisticated, multistage attacks that take advantage of the gaps and defenses, they're no longer the preserve of the highly skilled, well funded few. And the new AI capabilities that are used across all lines of business, they're opening up a brand new attack vector adversaries, a whole new way for them to compromise their victims. So to understand how AI impacts cybersecurity, I want to start by laying out how cyber security and AI interact. Now AI and cybersecurity actually meet in three distinct places. Most of your customers have never heard anyone lay this out cleanly. So by helping them understand this, you move from being the vendor to the strategic partner. Now the first pillar is AI for security. This is using AI inside the cyber defenses themselves, using AI to deliver better protection, better detection, better response. At Sophos, this isn't new to us. We've been using AI in our solutions since 2017, and we have AI in every solution, every product and service we offer. Let me give you a few examples. First, Sophos MDR. It has AI embedded across the whole detection pipeline. Now Dave is going to talk more about Sophos MDR in the next section, but let me talk to one use case. Sophos MDR has built detection and response agents using OpenAI's most advanced models. These have enabled us to compress our average response time from thirty eight minutes, which was industry leading a few years ago, to just eighty nine seconds when it's a fully AI managed case. Another great example of we can share is Sophos email. It runs more than 20 AI models to keep malicious mail out of your clients' inboxes before humans ever seen it. The takeaway I hope you have here is that with Sophos, you're giving your customers AI native defenses that use AI to deliver industry leading protection from today's threats. The second pillar is security from AI. This is defending organizations from AI enabled attacks. Frontier AI models can now find vulnerabilities and build working exploits for them in hours, even chaining together several minor flaws into one serious attack. So how do you defend when exploits arrive faster than you can patch against vulnerabilities you may not even know exist? Again, at Sophos, we have this covered for you. Sophos defenses are engineered to stop AI enabled threats. A great example is how Sophos endpoint stops vulnerabilities turning into breaches. Finding a vulnerability is not the same as using it. Whether an exploit is written by a person or generated by AI, it must still do the same few things once it reaches a device, run its own code, take over a process that's trusted, steal credentials, gain administrator rights, encrypt or steal data. Each of these steps relies on an exploit technique. Vulnerabilities number in the millions. Exploit techniques number just a few dozen, and they rarely change. Now most endpoint protection works a bit like a security camera. It recognizes suspicious activity, and it sounds the alarm, but only after the malicious code has begun to run. This is the model Microsoft Defender and CrowdStrike are built around. It doesn't stop the attacker getting in. What server's endpoint does it... Is it takes a different approach, universal exploit prevention. Rather than chasing each vulnerability with a signature or or a virtual patch, what it does is it blocks the techniques every exploit relies on. There's more than 60 exploit mitigations, some patented, which guard every running process from the moment Sophos endpoint is installed. It's on by default on every application, and there's nothing for you to configure before protection starts. So by blocking the techniques attackers use to exploit vulnerabilities, Solvers endpoints defend your customers from being breached by vulnerabilities, whether they were known, whether they were found yesterday, or whether they haven't even yet been discovered. Now we've got a great new exploits explained paper that goes into the detail. I do recommend taking a look at that. So let's come down to the third pillar, and that is security for AI. This is about securing the AI led solutions that organizations use across their lines of business, AI tools and AI in tools. The goal here is to enable your customers to use AI safely across their organizations. Now this is the newest pillar, the fastest growing conversation, and not coincidentally, where the biggest opportunity sits for you today. And this is where our new Sophos AI defense solution comes in. There's gonna be more on that in a moment from Ed. But stepping back, just laying it out cleanly like this, AI for security, security from AI, security for AI will enable your customers to take a massive step forward in their understanding about cyber security in the AI era and position you as the AI era leader that you are. Now talking about leadership, a big challenge is, of course, well, how do you stay in control across all these three pillars and across all of the security environments that you manage? How can you make everything run optimally and work together? Chris talked about MSPs being the conductor for the AI era. To unify the AI era pillars, the answer is that you need one central score, one shared score that sees everything, that connects everything, and enables it to respond as one. And that's exactly what Sophos Fusion gives you, a unified cyber defense system built for the AI era. We launched it in July this year, and the response has been incredible. From you, our MSP community, from customers, from industry leaders, Fusion is resonating. Now Sophos Fusion is our AI native cybersecurity defense system, and the word system is deliberate. It's not a platform. It's not a stack. It's a connected system built on our Sophos AI native cybersecurity defense system architecture. With Sophos Fusion, every product, every service, every data source, every analyst operates as one. It's not a bundle together. It's architecting them together from the ground up. Sophos Central has also evolved into Sophos Fusion. Sophos Fusion is the evolution of Sophos Central for the AI era, And it's enabled by our new architecture that combines the best of Sophos, the best of SecureWorks, the best of our AI expertise, and our automation expertise. All Sophos solutions are in Sophos Fusion. All of your customers are Sophos Fusion users, and Sophos Fusion delivers AI for security, security from AI, and security for AI. Let's take a look. Starting on the outside of the wheel, you can see the control points, endpoint, firewall, email, cloud, identity network. These can be Sophos or third party solutions. Now with Sophos, we have the most complete native security portfolio on the market. And while Sophos Fusion is fully open and vendor agnostic, Sophos solutions are, to use the orchestra analogy, first chair, the strongest first lines of defense. These Sophos solutions are where AI for security is realized for your customers. Every product, every service we provide has AI embedded in it, MDR endpoint, firewall, email, identity, XDR, you name it. And as I said, we've been using AI in our solutions since 2017 so you and your customers can deploy with confidence. Solus Fusion, built on our new architecture, was designed to stop AI enabled attacks. Because AI error threats don't demand more disconnected tools, They demand a different design philosophy. I describe soft fusion as a as a system, a defense system, because a system is what you need to stop AI error threats. There at the center of the diagram, you can see what makes the system a system, the unified context lake. All of the telemetry from every control point flows into a single shared data layer in real time. There's no aggregation delay, no separate data lake sitting alongside the product. The data's connected. Think of it as a a shared nervous system. And then we come to synchronized security, the connective tissue between the control points that turns shared understanding into a coordinated response. A detection at the endpoint triggers a response at the firewall. A compromised identity locks down access across the environment. A suspicious email heightens scrutiny at every layer. I like to think of it like a a modern building's fire suppression system. There's, a sensor in one room. It it detects smoke. It doesn't just sound an alarm. It closes the fire doors. It reroutes the airflow. It activates the sprinklers. The system is responding as one because it's connected. Now some of you will be familiar, of course, with synchronized security. We launched it in 2015 with Sophos endpoint and Sophos firewall working together, automatically responding to threats. That is still going strong. That is still defending hundreds of thousands of organizations every day. With Sophos Fusion, we've extended this approach across the ecosystem, thanks to the new XDR architecture. Sophos Fusion is actually the culmination of the vision we had when we launched Synchronized Security a decade ago. And then we come to Agentech AI, human judgment and accountability in command. So machine speed attacks, which is what we are collectively defending against, they require machine speed response, and that's what you get with Sophos Fusion. The system can detect, investigate, respond without waiting for human inputs. But it does so within boundaries, within guardrails that are defined and continually calibrated by our MDR analysts. So it's not automation running playbooks. It's AI that is reasoning. It's, thinking about novel situations, but humans are governing the trust boundaries. Humans remain accountable. So a great analogy is, I think with, flying. If you think of autopilot, the system is flying the plane, but the pilot is a person set parameters, monitoring the instruments, and taking over when the situation is novel or high risk. That's how Sopos MDR analysts work with Agentech AI. The AI handles the crews, if you will. The humans handle the crosswinds. And this system continues to learn, to adapt, to respond. Every threat encountered across the 625,000 organizations, Sophos Defense, every edge case that we solve, every new environment we onboard, it feeds back into the defense system. So the defense system doesn't just get bigger, it gets smarter. It's a bit like a vaccine, protecting everybody against what everyone else has already seen. So this is Sophos Fusion, the Sophos cyber defense system. It's not a collection of products with a shared logo. It's a single architecture that's seeing everything, connecting everything, and responding as one, whether the control point is ours or someone else's, to defend your customers against AI era threats. Now to bring this to life, let's watch a short video highlighting the power and the potential of Sophos Fusion. Picture a typical business environment, security and IT solutions from multiple vendors. Here Here we have Sophos endpoint, Sophos email, and Sophos firewall right next to Microsoft Entra ID, Microsoft Graph Security, and a second firewall from Fortinet. Every one of them is already feeding a single context lake in real time, managed from one console. Sophos Fusion is why everything that follows happens in seconds. The attacker opens with an AI assisted lure, a phishing page on a legitimate host. The user clicks and enters their password. The attacker advances. This kit does not just steal the password. It steals the live session token, so multifactor authentication is bypassed. Now the adversary goes to work. They sign in from known attacker infrastructure and create a quiet inbox rule that hides emails from one supplier. That is not random. That is the setup for wire fraud. And look across the board, four control points are lit. With other vendors, those signals sit in four separate consoles, and not one of them is loud enough to trigger anything. Here is the moment. A purpose built Sophos detection fires alongside the Microsoft signals, and they all pour into the same lake. No single alert tells the story. The attack is only visible when you see all of it in one place at one time. Seconds later, the agentic sock has the whole picture. Six signals, one attack chain, one console. This is where 52% of our cases resolve. End to end, no human required. Now watch the whole board move at once. The sign in is blocked, sessions revoked, the endpoint isolated, the malicious IPs blocked at the Sophos firewall surfaced by the Fortinet telemetry we do not even control. Eighty nine seconds from alert to automated response. This is Sophos Fusion in action. Automation stopped the access. A person closes the case. The analyst confirmed that the rule named a specific supplier. This is the other 48%. AI handles the volume. Humans own the judgment. And the system gets smarter. What we learned here now protects every one of more than 625,000 organizations we defend. The next customer to face this attack is already defended against it. This is not theory. This happened. A real world AI enabled incident stopped in seconds by the Sophos cyber defense system. This is Sophos Fusion. Now I mentioned that we have AI embedded in all our solutions, and so I want to take a moment to talk a little about the AI models as I think that's really important. So we use two different types of models at Sophos, our own and those of leading providers. We've been building our own models and securely deploying them in our solutions for over a decade. And securely deploying is an important point because building the models is only the first step. You need to engineer them into the solutions to ensure that they work in a secure and nondisruptive way. Additionally, we partner with all the leading Frontier AI providers to use the world's most advanced models in our defenses. So we're members of OpenAI's Daybreak Defense Network and Antopix project last week. In fact, in September, John Peterson, Sophos' CTO, spoke at OpenAI's cybersecurity conference. The video is available on YouTube if you want to watch it. I've talked about how Sophos Fusion delivers AI for security and security from AI. With new Sophos AI defense, Sophos Fusion also enables you to deliver security for AI. It enables you to see, control, and secure AI usage within businesses, the largest single issue for your customers right now. I'm gonna stop there so that I don't steal Ed's thunder. More on Sophos AI defense in a moment. But going back to our three pillars of AI and cybersecurity, all vendors can talk about one of these pillars. Some can talk about two. As a Sophos MSP, you have all three covered, delivered via Sophos Fusion. AI for security, security from AI, and security for AI. Chris talked about the cybersecurity orchestra. This is what writing the orchestra score for the AI era looks like. With Sophos Fusion, you're not adding another instrument to the noise. You're giving each instrument the same sheet music. Each one knows what the other is doing. For you, the conductor, it gives you the single collective viewpoint that enables you to have everything playing in harmony, delivering the outcomes your customers need all from one vendor. So let's now focus on that newest pillar, security for AI, with our new Sophos AI defense solution. Before I pass to Ed, we'd like to ask you a question. What is the single biggest concern you hear from your customers when it comes to AI? We have a poll here. Please share your thoughts, and we'll take a look at the results at the end of the session. Somewhere right now in every one of your customers' businesses, someone is using AI. It's embedded in the tools they use, every device, every line of business. And every click creates a risk. Each new prompt is a potential attack. The next copy paste, a possible leak. This is the single biggest concern for business leaders today. They cannot see AI. They cannot control AI, and they cannot secure AI. But they have to use AI because it's already everywhere. Their employees are using it whether they like it or not, and all of their competitors are taking advantage of it. This is where our new solution, Sophos AI Defense, comes in. The risk here is real. AI adoption is increasing faster than security teams can manage. Shadow AI is everywhere. 69% of organizations suspect or have evidence that employees are using public AI services against their company's policies. This is the orchestra playing off script. Data exposure is increasing. Sensitive data is being shared through prompts, uploads, and AI driven workflows. There's a fundamental lack of policy enforcement. Vendors are pushing solutions that typically surface activity, but don't provide the ability to enforce AI usage policy. Right now, as the conductor, you can't even see the stage. Sophos AI Defense has been built to fix exactly this problem. It sees all AI activity across users and devices, use of AI tools, and use of AI in tools, both sanctioned and unsanctioned. It delivers real world control and security with real guardrails and policy enforcement. All said, AI defense reduces risk. It stops threats that target AI solutions and prevents data loss via AI technologies. It's built directly into Sophos Fusion, so it's not one more console. It's the same score, one more section. But enough of me talking. Let's watch a demo. AI agents are moving from answering questions to taking action. They can browse the web, load skills, install packages, write code, and interact with systems on a user's behalf. That creates real productivity value. It also creates a new security challenge. The user believes they're working in a controlled workflow, but they may not see everything the agent does in the background. This presents a false sense of security where actions such as prompt injection are a real risk. In this walk through, we'll show how Sophos AI defense detects malicious activity initiated through an AI workflow and how protection can stop the attack before it continues. Here the user asks OpenClaw to research the Lazarus group. OpenClaw loads a research skill and begins collecting information from external pages, which is a normal kind of workflow an employee might use for research or automation. The skill does what it appears to do. It retrieves the research content and returns a useful looking report to the user. But one of the pages contains hidden instructions in the page source. OpenClaw treats those instructions as content and acts on them. Behind the scenes, content is downloaded and executed on the endpoint. From the user's point of view, nothing looks wrong and they're unaware that anything happened. They receive the research results. They don't see that the agent workflow has created an attack path on the server. Without Sophos AI Defense, this is where visibility can end. An attacker has a path onto the server while the user sees only normal research output. In detection mode, Sophos AI Defense gives the analyst the evidence needed to understand what happened. The activity is presented as a connected chain. The suspicious AI agent activity, the download and execute behavior, and the post exploitation actions taken by the attacker. The analyst doesn't have to piece together individual events manually. The case view summarizes what happened, highlights key findings, and provides the entities and detections needed to continue the investigation. For security leaders, this is important because it provides defensible evidence. The team can explain root cause, determine impact, and answer questions about AI enabled risk that would otherwise be difficult to validate. The case gives the analyst the roll up. From there, they can drill into individual detections to validate what happened. Detection details provide the process context, command activity, analysis, and recommended next steps needed to continue the investigation. This provides the critical visibility missing today. What access the AI agent had, which actions were taken, what was touched on the server, and what needs to be remediated. Without this context, security leaders are left trying to assess business risk from fragments and disparate systems. This is where Sophos AI defense changes the outcome. It doesn't just help analysts understand the full scope of an attack, it helps stop the attack before the attacker can gain a foothold. In protection mode, Sophos identifies the malicious AI agent activity and terminates it before the reverse shell can become an attacker session. The result is simple. No successful connection, no follow on attacker actions, and reduced business impact. The analyst still gets the evidence, timeline, and context needed to understand what was attempted, but the outcome is fundamentally different. The activity is already contained, so the security team is validating and responding from a position of control rather than investigating a full compromise. Prompt injection can turn a trusted AI workflow into an attack path. The user may only see normal output while the endpoint is exposed in the background. Sophos AI defense helps bring that activity out of the shadows. It gives security teams visibility into AI driven activity, connects suspicious behavior into investigation workflows, and supports response or prevention through Sophos security controls. Sophos AI defense is available as an add on and is fully integrated with Sophos EDR, Sophos XDR, and Sophos MDR. The result is practical AI security, better visibility, faster investigation, and stronger protection against the real ways AI agents are being used in the enterprise. To learn more, visit sophos.com/aidefense. Thanks, Ed. Now this is a good moment to talk about unlocking budgets, AI budgets specifically. Many of your customers already have an AI transformation budget. It's sitting in a different line than security. But by framing what you offer to the spending parameters of the AI budget, you can unlock it for your cyber defenses. Exactly how you position it will, of course, depend on the individual customer's budget parameters. If the budget is for enabling the organization to use AI to benefit the business, lean into Sophos AI defense and how it enables them to see, control, and secure AI usage so they can take advantage of AI without creating risk. Another good topic here is Sophos firewall and how it enables the AI era network that businesses need to run. We dive into this in the next session. If the budget is focused on reducing risk in the AI era, Talk about how software solutions, software's endpoints, software's firewall, software's MDR, deliver unmatched protection against AI era attacks. Also talk to how software's AI defense reduces the risk of attacks and data loss through AI enabled solutions. So when you're aligning the solutions to the different areas of the AI, you're not asking for a new budget. You're redirecting one that already exists. Now these budgets won't exist forever. This is the time to act. I hope you are as excited about this opportunity as I am. Now it's time to go back to the poll and see what you will rate as your customer's biggest concerns when it comes to AI. Great. Thank you very much, Sally. And Chris and Ed is... There's a lot of information there for everyone to take on. So, we will go through and just have a little bit of a recap there, to, to cover off some of the some of the topics that we talked about there. What I've got on stage... Sorry. On the screen for you, right now is there is a QR code here on the registration page. Sally talked about Sophos Fusion, the Sophos cybersecurity defense system and how you defend your customers, accelerate your business in the AI era. It's good for us to kind of now take a look at when's that gonna become available to you as MSPs and as Sophos partners. So looking at, looking at the, current, sorry, looking at the current timelines, that we are currently... We've got a clear, carefully planned road map to upgrade you and your customers to unlock all of the benefits, of these enhanced solutions. So we're currently well underway with the... With upgrading the existing EDR, XDR, and MDR term customers. And I mentioned this both because I know many of you also support term business as well, and also to share with you that we're maximizing our expertise at successful upgrades before we upgrade your accounts. So we're targeting MSPs or the MSP GA for late October. After this point, if you deploy our EDR, XDR, MDR solutions for the first time, you'll automatically get the new enhanced solutions. So we know how important it is as an MSP, sort of making sure that you have a stable and steady environment for your business. So we're executing a very carefully managed and curated upgrade process for existing EDR, XDR, and MDR customer tenants. After the GA, we'll start to upgrade MSP in... MSPs in small batteries, so ensuring all your customer tenants are upgraded at the same time to ensure you continue to have a single operating environment. You'll be notified in advance of your upgrade, and we'll support you throughout the process. We also want you to get familiar with using the new experience before we upgrade your customer tenants so that you are prepared and you are ready for the enhancements... Enhanced solutions. To help you get a hands on, we're running an, EAP program for MSPs where you can access the new experience in a single nonproduction tenant. So it gives you an opportunity to play with the environment, try it out before your customer tenants are upgraded and migrated. And if you haven't already tried it yet, we encourage you to sign up. So we're posting the URL in the chat, and we'll also add the resources page. Given that there is a huge volume of, MSPs attending today as well, I would urge all of you, as many as possible, to get involved in that EAP process. That also helps us to gather information and to understand where some of those situations that we may not have catered for will come up, and we can, resolve those ASAP and make sure that we have plans in place for for any similar profiled partners going forward as well. So please do make sure that you take the time to, to to get involved on that. Now as far as, the the first tranche of EAP participants, some feedback from from them, that I'd like to share with you. So love it. Game changer. Here are some of the things that come to mind. Threat intelligence. I absolutely love being able to research threat groups and tactics, especially those that are being briefed from other sources. Detections, the additional detections add context to events. Now, hopefully, that gives you a little bit more of a flavor as to what MSPs are experiencing in that EAP program, and hopefully inspires you to to give it a go yourself. So as I said, please do, take the time to to get registered and get onto the program. Let's talk about Sophos AI defense, and this is where you're gonna get your biggest conversations, and this is where the big conversations are at right now. We'll be showing how the overall experience works in session three later on, which will follow. But first, I wanna give you some details on availability times and importantly, the fact it's enabled by the new Sophos AI Sophos AI native cybersecurity defense system architecture in Sophos Fusion. What that means is your personal availability date depends upon your migration to the new architecture. So the Sophos AI defense solution will go technical GA on October 13. At this point, any term customer on the new architecture can run it. For MSPs, once you're on the new defense system architecture, you can deploy Sophos AI defense. If you want to go early with the architecture upgrade so you can deploy AI defense, please reach out to your account team. We know that sometimes it takes a number of months to sell in new solutions to your MSP clients, so it makes it the perfect time to start the conversation and start building in that level of capacity. It gives you time to ramp yourselves and the need that you build to sell it to your customers so it's ready for full availability. And it is a solution with a really exciting road map. The team will be dropping almost monthly updates, so expect it to continue to develop and advance right in front of your very eyes. One final comment for clarity, the Sophos AI native defense system is the architecture of Sophos Fusion. It's not a separate solution or SKU. However, Sophos AI defense is a new solution that is licensed and powered by the Sophos Fusion Defence system. I hope that makes sense to everyone. And with that in mind, let's let's move into a poll. So I want to take a moment to get some feedback from everyone on the, on the call. By the way, phenomenal turnout for the, EMEA markets. I'm really impressed with the number of people that have, joined. So you will see in the poll, oh, sorry. This is the this is the poll, sorry, from Sally. My apologies. So what is the single biggest concern that you hear from your customers when it comes to AI? So just looking at the overview here. So I... It was either you have the choice of the use of AI by adversaries, visibility and control of AI tools within your organization, cost and unclear value, or skills gap and workforce readiness. And, clearly, the visibility and control of AI tools within your organization is a... Is is clearly the the the winner by a long way. Now that is something that is inherent in every organization, that shadow level of AI across the... Across, any and every device, given the proliferation of AI embedded particularly in applications where there is no visibility or tends not to be any type of visibility. The challenge that you may also see and find is where there are apps that are being, accessed in real time via the browser as well. That visibility and control is managed within Sophos. So you have that level of control and that ability to be able to to, to defend the... The... Your business enterprise, against those types of adversaries as well. Interesting enough, the the skills gap and workforce readiness side of things, I thought that might have been slightly higher to be fair. There is a lot of information, and I'm sure all of you can see at the moment it's going at a dizzying pace. There are, versions and and, releases being issued by all of the large vendors. And alongside that, every application vendor or every, platform provider has their own upgrades within as well. So that skills gap and that level of integration and knowledge of integration between multiple independent systems and how to get them to cooperate, which new threats or which new exposures have been have been created as a result of those tends to remain unknown until you are either breached or there is some kind of extraction. So So it's always key to make sure that, again, a personal request from from me and from Sophos as an organization is focus on that skills gap, and workforce readiness piece. That's absolutely where you will win and continue to invest in your business in order to be able to cope and handle and manage the proliferation of different types of tools that are coming out and offering a huge amount of value, but not necessarily always hitting the spot. But, again, that's where the Sophos cyber defense, cybersecurity defense system comes into play. It is a system. It is architected and designed and built to take you irrespective of where you are on that journey to be able to encompass any of those threats and to to harness and manage those for your customers and for yourself. I'm going to move on to, another question. So, oh, okay. So this is this is one from Sally's poll. I'm sorry, but I'm I'm one slide behind sort of seeing concern you hear from the customers. That's gone straight through. So what we're going to do is we're gonna move on to our third session. So this, this session is, particularly good. One thing I will push... Pull you back into, to remembering. So Chris mentioned and Sally mentioned it as well in her her talk around the orchestra side of things, so different elements of of having, an orchestra come together. And I think you've got the string section, you've got the brass section, you've got the woodwind, you've got percussion, and how they all kind of interact and work with each other. The interesting thing I do want you to to consider, and I think Scott mentions it in in his commentary as well, is we're not looking at the partner as being just the conductor. So, ultimately, where this leads to and where this is driving to is you as an MSP, this is a business opportunity for you. This is how we as Sophos are going to help you to grow, build, and run as much as you possibly can, to... Towards building and creating a viable, sustainable, profitable, service line, business line, and revenue stream for yourselves over the next twelve to forty eight months. So I will say to you if you can continue to, to to, to keep your focus on the on the session for now, Please, bear that in mind. And with that, we will move on to the next session. The platform. Promise the connected defense, delivered a curated stack. Products with a shared console that still don't talk to each other. AI accelerated attacks find the gaps between them in milliseconds. Sophos Fusion is not a platform. It's not a stack. It's the most complete cyber defense system ever built. It sees everything, connects everything, and responds as one. An endpoint detects something at 03:47AM. It doesn't just raise an alert. It tells the whole system, every signal from every control point, from Sophos and more than 500 integrations, including the most extensive Microsoft connections flows into the unified context lake. Suspicious login, access is locked down across the environment, malicious email, security heightened at every layer, threat detected, firewall blocks lateral movement, issue resolved before the IT team even wakes up. Fusion AI deploys at every layer, detecting, investigating, reasoning, responding automatically at machine speed, human accountability in command, owning the outcomes, and the system learns. Defending more than 625,000 customers makes the system smarter. Every Sophos solution is part of Sophos Fusion. The more you deploy, the more value you unlock. AI native defenses defending against AI era threats. Sophos Fusion, securing the AI era. Welcome back, and thank you again for spending your valuable time with us today. My name is Scott Barlow, chief evangelist and global head of community here at Sophos. And I've worked with many of you guys over the years, and it's and it's been an absolute pleasure. If session two was about writing the future, this one is about the orchestra that actually plays it. An orchestra has four sections, woodwind, brass, springs, percussion. Every orchestra needs all four. None of them is optional, and none of them can carry the piece alone. Your customer security program has four sections, endpoint, network, security operations, and governance. And just like an orchestra, the moment one section stops listening to the others, you don't get music. You simply get noise. Endpoint protection, security for the devices that your customers are running, is the strings, the backbone which is always playing. Network security is the brass, power, presence, perimeter. Security operations is the percussion, tempo, the pulse, the most powerful sound in the room. And governance is the woodwind, nuance, precision, knowing exactly who is playing which note. And because it's all managed through Sophos Fusion, these sections don't just coexist. They listen to each other. A detection on endpoint informs a policy on the firewall. An identity anomaly triggers a response in the SOC. That is synchronized security. The difference between a stack and a system. And it's worth saying out loud, Sophos isn't just handing you a baton here. We're playing the first violin, the first drum. We are in the orchestra leading whatever sections you want us to, not standing outside waving our arms. As a Sophos partner, you're likely very familiar with the three sections of the security orchestra, endpoint, network, and security operations. So I'd like to start by focusing on the newest one, governance. And for that, I'm going to pass the baton over to Jay. Thanks, Scott. Hi, everyone. My name is Jay McDonald, product manager for CCO Advantage. Managing cyber risk has never been harder than it is right now. Let me put that out there. AI hasn't just increased the number of things that can go wrong. It's dramatically increased the speed and scale at which they can go wrong. Most of your customers don't have a CISO. In fact, only one in 10,000 organizations does. But somebody still has to answer the boardroom questions. Are we secure? And how do you know? Right now, for most of your customers, nobody can answer that with full confidence and evidence. That there is your opening. And this is where our new Sophos CSO advantage solution comes in. It's the strategic layer of Sophos Fusion, connecting assessments, reporting, strategy, and continuous improvement in a repeatable life cycle. Sophos CECL Advantage is a structured, repeatable service delivery tool that enables MSPs to deliver CISO level strategy at scale. With Software CISO Advantage, you can help your clients manage and reduce their cyber risk playing to one of the big three business focuses that Chris mentioned at the start. Software CISA Vantage gives you a structured way to deliver the CISA role that many of you are already playing across your customer base. First, it helps you turn the CISA role into a service instead of relying on ad hoc conversations and individual expertise. You gain a consistent framework you can deliver across customers. Second, it helps you drive your customer's security decisions rather than reacting to technical issues. You're leading conversations around risk, priorities, investment, and business outcomes. And third, it creates a clear path from assessment to revenue. Every assessment identifies opportunities for improvement, helping you build a road map that delivers value for the customer and creates opportunity for additional products and services. At its core, software CISA Advantage helps you deliver CISA level strategy at scale and strengthens customer relationships and create recurring adversity revenue. It provides a baseline assessment against live environment data and threat intelligence, a board ready reporting that translate technical findings into business language, a prioritized road map identifying gaps to improve maturity, but opening up services and product opportunities for you too, and continuous monitoring that proves progress over time. And as with all software solutions, AI is baked in. AI accelerates the assessment, analysis, and reporting, so this isn't a service that eats your best engineers week every quarter. It improves it and raises the bar and quality for all your engineers, where increased quality of work and scalability comes together. As I said, software assist advantage is a brand new offering, a brand new opportunity. And so I want to share some feedback from one of our early access program or EAP partners, David Peck from Trevant. He shared that software's disadvantage gives us a structured way to deliver something we already do informally. We can now walk into any customer conversation with a clear program, a prioritized plan, and reporting that leadership can buy into. It has elevated how we position ourselves. Software CEC Advantage is a new offering. The potential for partners is huge. We've got a full enablement program to help get you there wherever you are in your current service delivery, including four key items I wanna highlight. Number one, solution enablement. We have a winning with softwares... CISO Advantage course for MSPs. Number two, we provide guidance on how to package your service. For example, how to size and price it. Number three, get hands on experience. There are NFR licenses, and it's live. I know that there are some eco partners out there who have already seen this and jumped on it and have already activated it. If you haven't yet, I encourage you to do so and to try it out. So lastly, number four. In addition to all of that, you have five hours of free enablement that walks you step by step through how to deliver the service using the tool. The commercial case for MSPs is clear. 90% of your clients are concerned about security and regulatory compliance, and your services team already spend 39% of their time on compliance activities. Software CSUL Advantage turns that burden into a structured, billable, board facing service. So how does this actually show up in your business? It starts with the service itself. You can build level guidance into the base managed service you already deliver, creating a more strategic and valuable customer engagement. From there, you become the trusted advisor. You're leading the security conversation, guiding customer decisions, and showing up as an extension of their leadership team. That's what positions you as your customer CSO. Ongoing reporting and measurable outcomes keep you embedded in the account, strengthening renewals and driving recurring advisory revenue. You help them understand risk, prioritize actions, and build an ongoing cyber improvement journey. This is the moment your customer stops seeing you as the security vendor and starts seeing you as the person who can stand in front of their board. It's also the moment your business becomes harder to replace. So now let's see in action. Let's watch a demo. Welcome to CISO Advantage. 88% of MSPs say their customers already rely on them to act as their CSA. Most of that work is informal and unbilled, and it looks different every time. CSA advantage gives it structure that you can repeat. Let's look at how easy it is to license a customer for CISO Advantage. Come into your PDB environment and select a customer. In this example, we're going to use cyber security. Click change licenses, and you can see here, we get the license selector. We see here we get an option for CECO Advantage. CECO Advantage is licensed simply. It only requires one license regardless of the size of the organization billed monthly on flex. We can see this customer has already got the license selected, so let's review the selection and close this out. Now let's change into this customer's context. We can now see here that we can go into CISO Advantage. Let's do that now. Our customer is Cypher Security, a 10 person consulting firm in The US. This profile holds the shape of their risk, their size, their industry, and their location, and how much their organization would depends on IT, and what kind of data it holds. We can see here that they have a tolerance of fifteen days for disruption, and they have around 25 assets that they manage. We can also see their regulatory profile. This context drives the framework choice. For a firm this size, it's SysVA. And for every customer you onboard, it starts from the same structured baseline, whoever on your team sets it up. The assessment runs control by control. Each safeguard sets out what good looks like and what to ask. Take this asset control. Cypher has it pretty much in hand with... And understands where their assets are with the exception of a couple of devices. Let's score what we heard. So, yes, it sounds like it's in a good place. Let's record a note that describes what the the customer talked to us about. Let's add that in here. And, also, let's attach some evidence. So if as part of the process, we, got hold of an asset inventory policy or any other documentation. Let's upload this piece of evidence, and we can see we've added that. Now the finding has the evidence behind it, and nobody has to take our word for it. Scoring follows the same method. Two consultants assessing the same customer should land at the same pace, and that consistency is what lets you put less cons... Experienced consultants on an engagement and still trust the results. But your newer consultants won't know every safeguard by heart. I'll ask the assistant what about what testing data recovery means for a 10 person firm and what evidence to request. So let's come in to this control, and let's use the AI feature. So let's get it to explain the control. The assistant never writes the assessment. If something's useful, the consultant can add it, and the judgment always stays with your people. The assistant just cuts down the time it spend... It it takes to look down things. So we can see here that it's giving us an answer. It's broken down into plays... Plain English. It's looked at the different individual components, and it also explains why it matters for an organization like this. Now most of this is... Assessment happens in conversation. Normally, someone takes notes and then spends an afternoon trying to type them into controls. Here, we upload the team's transcript for our call with Cypher's managing partner. CSAVantage can either match the transcript against all of the of the controls in the framework, or you can choose specific ones. And that's it. As simple as this. You kick off the process, and it starts to analyze the conversation. Let's review the transcript. CISA advantage matches what was said to the relevant safeguards. And for each one, you get a draft score and a finding and a draft note along with a, with a confidence level and the exact lines in the transcript that the analysis came from. Click a citation, and you're at this point in the conversation. Let's go through and edit a couple. So we can see here we can come in and edit. So you always stay in control. We save that, and we can choose whether or not we're going to allow just the score in the note, the score only, or the note only. If we go through now, we can select to walk high confidence, and we can review the changes and apply these. That means every person in your organization has the ability to perform the assessment like an experienced auditor, all without having to give that knowledge and experience to each individual. Now let's see how those changes have landed in the assessment. We can see here that some of the controls have this blue icon, And this allows us to see where AI has automatically provided a score. And if we go to the evidence, we can actually see exactly in the transcript where the conversation was... Where the where the analysis took place. This gives you repeatability. It gives you scale, and more importantly, it gives you traceability back to the findings. It ensures that you stay always in control even while taking advantage of the AI's capabilities to drive efficiency. With the assessment done, the findings dashboard says where Cypher stands, maturity by control, and the gaps ranked ranked by risk. And we can see how they've changed over time as well. Next comes the report, which usually eats a senior consultant's weekend. CISA advantage drafts the executive the executive summary in business language and straight from the assessment data. We can see here that it's used the organizational context to establish what the organization looks like. We can see that it provides overall posture score and modeled exposure in financial terms. It shows top performing areas and areas of focus. We can see here it provides financial analysis for business leadership. The report is broken into two. So the second half is for IT leadership. So, again, it goes into a bit more detail, allows them to look at what their gaps are, and also gives, importantly, a ranked set of recommendations. So we can see here, we've got a top five recommendations for this organization. Again, you don't now have to kind of manually write all of these. Again, what happens is the system is able to understand how this organization is likely to get attacked, and we use Sophos' x ops data to build a threat profile for this organization and prioritize the recommendations based on those that are going to be most impactful at disrupting malicious activity. Let's finish this assessment. Let's render out the PDF, and this is the final output that you'll share with the customer. High quality looking report ready to go. You haven't had to manually write this. You haven't had to spend your whole weekend, putting this together, and it's ready to be shared with your customer. So this is one process for every customer, whichever consultant runs it. This is CSER Advantage in Sophos Fusion. I know I'm biased, but wow. Right? I hope you show my excitement about c... Sophos CECO Vantage and how we can accelerate your business. Now let's turn to another section of the security orchestra, the brass. For this, let me pass over to Barbara. Thank you, Jay. And, it is very exciting, but I've got something equally exciting to talk about right now, and that's namely network security. My name's Barbara. I'm a product marketing director for our network security products and it's a pleasure for me to be able to talk to you about the exciting things that we have available to you today. First of all, I'm going to focus on a question that I'd like to ask you all. Which network led security service do you expect to grow the fastest over the next twelve months? Is that going to be managed firewall services, MDR or NDR services, AI governance services or the more traditional network refresh and modernization projects. If you would share your thoughts with us, we'll take a look at the results at the end of the session. Every business depends on its network. It's the thing that connects people, devices, applications, and cloud services so that work can actually happen. AI is elevating the strategic importance of the network. Every prompt, every model, every agent, and every automated workflow depends on it. And whether AI is calling APIs, accessing cloud services, or retrieving data that traffic ultimately traverses the network at some point. That's why ai doesn't just increase the volume of traffic it raises the stakes. And as organizations become more dependent on AI powered systems, they need security solutions that can protect that activity at scale. So why does the mat... The network matter so much in the AI era? Well, it's because the... It's the one place that defenders can buy themselves some time when attackers are moving faster than ever. It's often the place where things are seen first and it's often the place where you can act first. You just think of a rule on a firewall that can literally change the real level of risk. The challenge your customers are facing is that often the traditional network has been built for a perimeter that no longer exists. It's assumed that the network edge was the security boundary and that everything within that could be trusted. It was also designed for more manual operations. If you think of hand built policies and more reactive patching. And it comes as no surprise that we know that that model doesn't hold up in the AI era and in fact it hasn't held up for quite some time. Today's networks have to defend against increasingly sophisticated attacks that are operating at machine speed whilst also delivering the performance that's needed to support encrypted, application rich and AI enabled environments. That's why our vision for the AI era is relatively simple. It needs to be engineered for performance and connected for defense. Your customers can no longer afford to choose between security and performance. They need the capacity to inspect, analyze, and secure growing volumes of traffic without compromising the user experience. And they need every single layer of that network to be contributing to a coordinated security posture. This is where the network becomes uniquely valuable. It can see things that no other security control can see. For example, encrypted traffic that's moving at machine speed. And the volume is now beyond what any human review cycle can follow. There are devices that can never carry an agent. If you imagine all the IOT, OT devices, maybe devices used by contractors or other unmanaged systems, those are completely invisible to endpoint reporting. And of course, the network needs to not look... Just look at Northwest traffic, but also East West traffic, because it can connect that activity from the edge to the interior as one single picture. You imagine your firewalls, your switches, your APs, and NDR contributing context that creates a complete visibility rather than just isolated views. And, of course, lateral movement. We know that many risks today come from people that have logged in with stolen credentials. So East West traffic is often where an intrusion can become an incident. And that's something, of course, where solutions like NDR can really help. And the network often can see things before they happen. The network sees signals of an attack before it reaches its objective. In fact, our 2026 state of ransomware report revealed that the firewall generated a detection before data encryption in sixty one percent of ransomware incidents. So the network sees things first and can act fastest, but only if you're connecting the signals. But imagine what happens if nobody's connecting those dots. Well that's why Sophos fusion is so important as it enables you to provide comprehensive network coverage and it connects all of those signals for you for coordinated response. And every layer of the network plays a role because each sees something different. The firewall identifies AI services that are in use, so we have a dedicated category for that. And it also identifies early stages of an attack. Your wireless access points and switches are often ignored when it comes to security, but they deliver really important context. They know what's connected. They know where things are connected and they know which segment they're on. Together with the firewall, they can create the network map, which is something that we recently introduced, which gives you a shared operational picture and also adds context to the unified context lake. And NDR or network detection and response is the sensor for everything that can't take an agent. All of those unknown and unmanaged or agentless devices that endpoint security simply can't see. Workspace protection not only provides secure access to web and SaaS solutions, with a protected browser there's a really important AI governance angle as well. It can allow sanctioned AI services, block unsanctioned ones, and also control what data can be shared with generative AI. And because all of this is part of Sophos Fusion, every layer contributes to the shared picture allowing protections to work together and respond faster. If network security is the brass section of the AI era orchestra, every player has a role to perform. The trumpet, the trombone, the tuba and the french horn, every instrument contributing to the final piece. So as we've seen, a network that's engineered for performance and connected for defense depends on every layer working together. But nowhere is that vision brought together more clearly than in the firewall. That's the heart of your network security business. Let's take those three pillars of AI and talk about how Sophos firewall covers you at every point. First, there's AI for security. And I'm sure you know that Sophos firewall uses AI to strengthen threat detection. It also improves protection and helps security teams focus on what matters most. And with a new AI assistant coming in Sophos Fusion and also automation coming in v 23 in early November, we're making it easier than ever for MSPs to manage, troubleshoot, and operate firewall environments at scale. Next, the security from AI. And we know that one of the biggest risks introduced by advanced AI is its ability to discover vulnerabilities and build working exploits at a speed that traditional security processes simply can't match. There's no manual patch program that can come close to staying on top of this. And that's why Sophos firewall is engineered to be secure by design. We're minimizing exposure by hardening the firewall from the code to the core, eliminating whole classes of vulnerability, and integrating things like the built in health check to identify risks such as those that come from misconfigurations. And our unique over the air hotfixes can patch automatically. So whilst you and your customer are sleeping soundly, we're making sure that there's no customer downtime, there's no MSP overhead, and we're closing that exposure window whilst ensuring business continuity. And security for AI. We heard earlier about Sophos AI defense, which is a really exciting product introduction. And Sophos firewall and later Sophos workspace protection will integrate directly with Sophos AI defense, enabling AI tool visibility and control from the gateway right through to the browser. Our firewall is also built specifically for you as an MSP. Features such as zero touch deployment and SD WAN orchestration reduce the overhead associated with deploying firewalls, for example, in remote locations. Group management across every site you support makes it easier to take on new billable clients. And it's fully MDR ready, not working in a silo. So a firewall event feeds the same detection pipeline as everything else in Sophos Fusion. Earlier this year, we introduced hardware as a service which many of you have been waiting for for a long time. And this new delivery model gives you expanded flexibility on how you bill and deliver Sophos firewall by removing that upfront cost that we know has been a hurdle in many cases. And it's only getting stronger. In early November with Sophos firewall v 23, as I mentioned, we bring in an AI assistant that's gonna help you to create rules. We're also expanding automation with a modern REST API. There are significant improvements to and many, many more things that we don't have the time to go through today. But all of this results in less operational overhead, faster troubleshooting and greater consistency across your customer base. To learn more about what's coming, be sure to join our partner academy sessions on October 20. Now we've heard about the brass section, let's turn to percussion security operations. And for that, I'm gonna hand over to Dave Marils, who is the VP of product management for security operations. Thanks, Barbara. In an orchestra, percussion does more than just create impact. It keeps everyone playing to the same tempo, and security operation serves the same role in cybersecurity. It's the function that turns dozens of dozens of signals, alerts, and controls into one coordinated rhythm. I want to start with the reality. Let's level set. In the AI era, security operations is not a nice to have. It's essential for the security of any organization. Customers want 20 fourseven monitoring, expert investigation, faster response, and strategic guidance. If you're not offering them, your customers are at risk and so is, I'll go so far to say, your business. This isn't new. Sophos MSPs have already been providing security operations at scale for years. What's changed in the last six months is the tempo. We heard about this in the previous section, but let's reiterate here as it's directly relevant to the SecOps conversation. AI has accelerated both attack execution and the attack progression. The challenge isn't simply that there are more attacks. It's that events that once unfolded over hours now happen in quite literally minutes and seconds. Adversaries use AI and automation heavily. They use it to fish, to map, to script, and move faster across your environment. Using legit credentials and trusted tools to evade single control point defenses. This increases the volume and sophistication of attacks that need to be stopped. At the same time, AI has expanded the attack surface. We've all heard that one. All the new AI enabled solutions provide a new target, a new way in. And AI tools make it easier for attackers to reach and exfiltrate at speed, sensitive data flows through email, files, SaaS applications, collaboration tools, and human identity themselves. Your customers need security that can do three things. One, connect disparate signals to identify attacks that individual point solutions and control points cannot see or stop on their own merit. AI means multi layer attacks are moving from the exception to the norm. Respond at machine speed, matching machine speed attacks. And three, balance agentic AI response with human judgment and accountability to get the right answer for each situation. And that is exactly what Sophos' AgenTix SOC provides and delivers. Starting with detections, with the attackers using AI, they're moving faster and with more scale. However, the fundamentals haven't changed. They still are doing credential theft, Kerberoasting, domain generation algorithms, DGA, C2, command and control, exfiltration, hands on keyboard intrusion. What AI fundamentally changes is speed and scale. Attackers move faster to try and achieve their objective, but the tactics and techniques are largely the same. And that's why our answer isn't let's just bolt on an AI detector, It's that AI is already embedded across our entire detection pipeline. We are running AI driven models across dozens of cases today. From credential and identity abuse to DNXX fill, we already mentioned in DGA, domain generation algorithms, to behavioral anomalies like rare program to rare IP, login anomalies to email compromise. So, faster attacks get met with faster AI accelerated detection, not a new category of defense. These are examples of that in action. AI based detections are already deployed across identity, network, endpoint, and the email threat detection use cases. Now we also leverage AI at every point in our security operation solution, Sophos XDR and Sophos MDR. This is another great example of AI for security. For example, AI features such as case summarization, command analysis, natural language search, streamline expert workflows. They reduce friction, they accelerate outcomes, they lower the adoption barrier of our products using AI features. AI assistants, they help analysts, our analysts, you, your analysts, and customers investigate faster, validate decisions, and operate with greater confidence. And our autonomous agents execute high value operational workflows within guardrails to improve speed, quality, and consistency at scale. You can choose the delivery model that works for you. Most of our MSPs and hopefully most listening today start with Sophos MDR. If you prefer to run your SOC in house, you have your own team, use our new greatly expanded Sophos XDR offering, both of which combine the best of Sophos and SecureWorks capabilities. Layering the new Sophos' next gen SIM when a customer's compliance or visibility needs demand it. They'll love you for the cost saving you deliver versus those standard legacy SIM ingestion and storage. And you'll love the ability to reallocate their budget to higher margin solutions. Of course, not every customer is ready for a full SOC strategy. They might be earlier on their cyber maturity journey. For your existing Sophos customers that aren't ready yet for the full XDR or MDR, Sophos EDR enables you to guide them to the first step in that journey and providing vital telemetry for Sophos AI defense. Now let's sidebar for a moment to talk about identity. Identity is now one of the major attack surface with compromised credentials, active sessions, and identity abuse being a main root cause of many, many instances. We've been saying this for many years. In an AI era, that identity layer now extends beyond people to include service accounts, applications, workload identities, and AI agents themselves. Hopefully, you're already familiar with Sophos ITDR. It enables detection and response to identify threats across both human and non human identities, bringing that critical context directly into Sophos Fusion and the agentic SOC. ITDR is fully integrated with Sophos XDR and Sophos MDR. However, as of this month, very excitingly, it's also available standalone. So for new customers taking their first step into Sophos Fusion, Sophos ITDR is now one of the easiest places to start. It addresses one of the fastest growing attack surface and gives customers immediate visibility and protection while establishing the identity foundation that feeds Sophos Fusion. From there, expanding into EDR, XDR or MDR becomes a natural next step in that journey. I mentioned the importance of balancing machine speed with human judgment. With Sophos MDR, AI handles the scale. 52% of cases are now resolved end to end by AI with no human intervention. Let that figure sit in for a bit. And the average time from alert to automated response is eighty nine seconds. And that means our expert analysts are freed up to focus their time on the remaining 48% of those cases where human judgment is most critical. Humans handle the judgment, a Sophos analyst supervises, they investigates the cases that need a person and stays very importantly accountable for that business impacting call decision. Nine regional SOCs, 40,000 plus organizations already trust the service and critical incident response with no hourly limits or extra fees. As I've said, we use AI at every stage, and I'd like to touch for a moment on the models behind the solutions. It's a common question a lot of customers, a lot of partners ask. Our goal is to use AI to deliver the best outcomes. And that means using the right models at the right times for the right use cases. At Sophos, we use a combination of models built in house by our experts and models from leading AI providers, including OpenAI and Anthropic. Just one example with Sophos MDR, the agents we've, we've built using OpenAI models have transformed our operations by enabling us to automate workflows end to end rather than automating only individual portions of the process. It's the full end to end lifecycle fully autonomously managed. And our strategic partnerships with the Frontier AI providers gives us a distinct advantage over adversaries. For example, because of... Because our work involves sensitive security data that can sometimes trigger the safety classifiers used by AI providers, our participation in the OpenAI Daybreak Defense Network provides important context. OpenAI understands that Sophos is a trusted organization operating within a legitimate security focused use case, which gives us greater flexibility in applying these models to our MDR workflows, helping us deliver superior defense against the most advanced attacks. As I said at the start, security operations is the percussion section, the pulse that keeps every other section in time. You get this right, and the whole orchestra sounds like one well oiled beautiful performance. In the next session, we're going to show you what that performance actually looks like. But first, let's go back to our host and hear how you responded to the poll. Great stuff. Thank you very much indeed. That was a great session there by, by David and, the rest of the team. While we are about to start, I also want to introduce, Savannah Katcher onto stage with me as well. And Savannah is going to be joining me, for the q and a session that we will have just to pick up on some of the questions and answers that you've, the questions that you've been asking over the course of the presentations as well. But before we, before we kick into the q and a, let's let's just dig in a little bit more into, into, some of, just have a a recap with regards to, what Scott covered there as well. So, Scott compared today's complex security solution environment to an orchestra. So he talked about the four different core sections, each of them playing a different but vital critical role, in the environment. Endpoint protection is the string section. It's the backbone. It's consistent. It's always playing. The net... Network security, crib is the brass section. It gives power, presence, and defines the perimeter. The security operations is the percussion, which is what Dave was just talking about that Dave Murrells. It provides tempo, and it's usually the most powerful sound in the room. And then strategy and governance is the woodwind section. So it gives nuance. It gives precision. So, you you heard Jay talking about CSO advance. That kind of helps to get more of a color and more more of a picture there. Because it's all managed through Sophos Fusion, these four sections listen to each other. They work together. They play in harmony. And and you you are the conductor for the AI era, but you are you are the orchestrator of all of the tools and all of the data, the telemetry, and the value that that's providing to the customer. That's the key difference in terms of your role and how you pull all of this defense system together into something that is valuable, that drives that discussion and drives that conversation, and more importantly drives revenue for you as an MSP. So let's just talk about some of the takeaways that we got from the session from from Jay. Now Jay talked about CSO advantage. So this is a whole new area of opportunity, a whole new, complete revenue stream, an opportunity for growth for for all of our MSPs. You are already playing the CSO role for many of your clients. You have that advisory role. You have that trusted, you are the trusted voice for for your customers. This is how you turn that into a scalable billable service, and you put yourself and your services at the heart of your customer spending decisions. Now a quick note on language and availability. I know it came up in one of the questions, earlier on. Sophos, CSA Advantage is currently available in English only. We will look to have it available in all core languages, by the end of this calendar year that we normally support, and it's currently available in EMEA and North, North American data centers. It will be coming to Australia and Japan data centers later this month and then to our India and Brazil data center in November. Now as Jay said, we do have a lot of resources to help you to get comfortable with CECO Advantage. And if I can pick one in particular, I would encourage you to activate the NFR license and to to get hands on with with CSO Advantage to really, understand sort of, you know, where it sits, how it operates, and dig into some of the features there with regards to importing data and and really trying to to to build a a compliance dashboard, for your for your customer. The NFRs are free for all gold and platinum partners, and it's at the 75% discounted rate for silver and authorized partners. Any questions, do please feel free to contact either your distributor or your... If you're a managed account through your MSP CAE. Secondly, we were talking about the securing the AI era network, which is gonna be key in protecting organizations in this era. So Sophos firewall is still at the heart of that program. The version 23 EAP is now open. Check it out. Check out the new hardware as a service option. As many of you know, that was launched at the beginning of August, end of July. We've had phenomenal feedback and phenomenal uptake of that as well. It is really proving to be a lucrative business line for a lot of our MSPs. In our Central Region, it has taken... It is literally taking flight. And, for a, for a for a period in the, North Region, we're also seeing a substantial amount of uplift. What I would ask you to do is to get involved and see if you can identify as many of those opportunities as you can for firewall as a service. It does work in your favor from a procurement and cash flow point of view. And then finally, where Dave Marils was was talking around MDR, this is where agentic speed, human judgment, and accountability combined. They come together, eighty nine seconds he was talking about. So eighty nine seconds from end to end attack resolution when it's fully agent led. Now as a Sophos MSP, this is the speed of defense that you give to your customers. So you can ref... Relax and focus on your business or on the weekend, your family, your own personal interests, knowing that you've got that in hand. So there is a lot to take on there. There's a lot of information and a huge amount of benefit. Now one of the reasons why we wanted to bring everybody together specifically to to do this MSP summit is there is a huge amount of information and amount of, releases that we are delivering, as Sophos to the MSP community. It's been... In the pipeline, it's been, being worked on for some time. And I think now is the right time for us all to really jump onto as much of that information that we can that you will see through portal, and and to continue to advance your business. A lot of you will also be in this planning stage now. So we're we're entering into the fourth quarter of our our calendar year. And planning, objectives will be in place, financial planning, etcetera, people planning, resources. And this is really the time to sit down with your MSP CAE and go through how do I accelerate my business? How do I take the... Take our MSP to the next level? We currently offer a set of services. What does the next set of services need to look like for us to remain competitive in our market, for us to remain, profitable in in what we what we deliver as well? But most importantly, and and here's the kicker, where there is additional service capability, and I'm really leaning hard towards CISO Advantage, where there is additional service capability that you are already providing and you have an opportunity to now monetize and create something that is a deliverable to a customer that they pay for, that is a no brainer. So absolutely get involved in in the CISO Advantage side of things. So as you can tell, I really like CISO Advantage. So before I, I I get completely lost on that, I will, move on to the, poll. So, Barbara asked the question, which network led service do you expect to grow fastest over the next twelve months? So I believe the poll did go up, and I will welcome in Savannah at this point as well. Hey, Savannah. Good to see you. Thank you. You too. Excellent. So if we take a look at the results of the poll, we had just over 10% of our votes for managed viral services, just over 32% for MDR and NDR services, just under 50% of the votes went to AI governance services, and 8.4% went to network refresh and modernization projects. Brilliant. Now. Sorry. Go ahead. now as I say, that is, quite surprising. I mean, if we take a look about a year ago, if we've done the same poll, MDR and NDR probably would have come out on top. But now we're seeing AI governance services come out with almost double the votes. So, it looks like, you know, customers are now asking how to use AI safely, how to control it, how to stay compliant, and how to manage those risks, which creates a lot of opportunity for our service providers and advisers. Totally. And with and with the with the governance service side of things as well, I'm I'm actually currently at at, Canalys, which is the Ondia, events. And, a lot of the assessments from from the industry is is geared in exactly the same way. So the AI governance services side of things is absolutely where they are driving the narrative out to all of the SIs, GSIs, the MSPs, etcetera as well. And it's something that is being driven by not only controlling that that base of AI within the organization, but then also how that how that translates into their own, governance, risk, and compliance profile as a as a as a customer in their industry, in their segment vertical, etcetera. So it's becoming more of a more of a feature. So, yeah, that's good to see. As always, MDR and NDR is always there, which is, great. Any, any sort of, thoughts on that there, Savannah, with regards to MDR and how it's continuing to grow? Yeah. I mean, it's still... 21 rates is still a very strong result. I think it reflects the reality that organizations are still struggling with the skills and the resources and the time that's needed to provide that twenty four seven threat monitoring response. So being able to outsource that to a SOC service, to an MDR service provider like SOPOS It's the the way that businesses and MSPs are still moving. Fantastic. And if you if, if you go into the docs section of of the Goldcast here that you can see of the, platform, you'll see that there is the MSP perspective report 2026, which is a great, a great report, which I'd advise everyone to kinda go through and really get a a handle in terms of understanding where the trends are and what kind of analysis we've we've done across the whole of, EMEA. I think it's in total around 800 different partners. It's quite a quite a, subsection of, of partners, different types of different types of segments and and operating models. But it's, it's definitely a worthwhile read and something that you should take up to your board or your... To your investors and just say, look. This is where the market is heading. This is what Sophos can see coming down the line, and this is how we are geared and positioned to to really kind of, build on that as well. Now... So as far as the, q and a side of things, so we've had a huge amount of q and a, come in. So, we. will tag team off the back of this. So, Savannah, are you ready? We've got a a chunk of, questions in there. Brilliant. I'm ready. Okay. Superb. Let's, let's get stuck in. So let... I'll I'll do, I'll I'll do the first question. You can do the first answer, and then we'll we'll swap after that. But let's go with the first question. So what's the difference between the AI native cyber defense system and Sophos AI defense? So I'm not sure where that one's come in from. So do you want me to take that, Savannah? Yep. Sorry. Bear with me. I think my Internet's coming out. No. There we go. okay. That's alright. Sophos Fusion is the AI native cyber defense system. The architecture that is the architecture that powers all Sophos solutions. It's not a separate solution or SKU, so all customers are ultimately Sophos Fusion customers. Sophos AI defense is a new solution built on top of Sophos Fusion that you can sell and use to deliver security for AI to your customers. Brilliant. Brilliant. So... And and, again, for for for anyone that's, anyone that kinda wants to go into any more detail specifically around the way we've... The the the kind of naming convention, I know some of the terminology will be different. It would have been new for some of you as well, so please feel free to go into the partner portal, have a look and and kind of have a have a look around all of the assets that are currently there as well. It will help you to define those glossaries in there as well for you to be able to to really get under the under the hood of, what we're talking about there as well. Next question. Next question. Yes. I know we already covered this, but it's pretty... It's probably gonna be best to to go through again. So when will AI... When will Sophos AI defense be available to MSPs? So, it will be available. So so AI defense is, is built on Sophos Fusion. So so the the... Which is the the AI native cyber defense system. So it's an add on to Sophos EDR, XDR, and MDR. So it's available to MSPs once your customer tenants have been upgraded to the new architecture. So I know you're all keen and really kind of revved up and ready to go out there and to to to get involved with all of your, customers and to to share the AI defense piece and to start selling that, out. It it is there. It is it is more of a... It it it will be... Once your tenants have migrated over, and upgraded to the new architecture, then you will have visibility of AI defense. So let's, let's throw over a question to you then, Savannah. Let's, let's play q and a ping pong. So how is Sophos AI defense licensed? So AI defense licensing is straightforward. Sophos AI defense is available as an add on to Sophos EDR, XDR, and MDR. So the license Oh, I'm not sure we can hear you. No? It. is users. for service, Hey, Sally. by Hi. Sophos. Hi, Navin. I think we're just having a little connectivity Yeah. issue there think we are. We. we lost a piece of Anna Midway there. Thanks. for jumping in. So just on the, licensing, so from, from from, from an add on as an add on for software CDR and XDR and MDR, what can you tell us, Sally, from a licensing point of view? Yeah. So licensing's super straightforward. As you say, it's a... It's an add on. The license seat count, so users per service for softwalls AI defense, it needs to match the count for softwalls EDR, XDR, or MDR. So so very straightforward, very easy for for you to add it to your customer's defenses. Perfect. That's brilliant. Thank you. Now. I've got a question. Sorry, Naveed. I've. got. a question away. for you that's come in. So we've had a number of people who've asked in the chat about local frameworks. Obviously, there's lots of different frameworks out. Could you maybe talk to us about the the coverage frameworks and how MSPs can request coverage for for frameworks that are relevant to that region? Yeah. There's... So so that's a brilliant question. As far as the frameworks, you're right. There are so many out there and MSPs are expected at some point to either know or be aware or cover them in some way, shape, or form. But the... You know, the... With those sort of that volume of frameworks, we wanna focus and prioritize the ones that we can see based on needs, based on sort of governmental requirements, the ones that are really kind of driving the conversation with our MSPs. So if there is a framework that you would like to have covered, then please email our PM team. So there is an email that I will, we can share in the chat, which is ciso-adv-pm@Sophos.com. And then we can have that conversation and really kind of evaluate where does that sit and how we can help to support that in the platform, build that out, and, make that available. Really good question. I've got a question for, for yourself now, Sally. I'll throw one over to you. So hardware as a service. So this is an interesting one. So Barbara mentioned about hardware as service. It's something I was I was talking about earlier on with regards to the volume that we're seeing, the uptake that we're seeing. How can we find out more about hardware as a service, that Barbara mentioned? Yeah. Yeah. So as I say, lots of interest in hardware as a service, and and it's an addition. It's giving you another option, another way that you can deliver that AI or network security for your customers. So the best way to find out more about it is to speak to your Sophos, MSP team, your local team. They'll be able to explain how it works, which of the XGS models are available that... With that billing model and help you identify how this can support you as as you grow your business. So do reach out to your team. They'd love to talk it through with you, understand how it fits into your business. And to your point, earlier, Navi, build together a shared plan for growth. Fantastic. And then and then also to kind of segue into another one of the questions that has been asked, which is around how do we get more information around this. You'll know that there are focused partner academy events that are happening, across both EMEA and also in The Americas as well and APJ, I believe. But for EMEA and Americas... In in EMEA, it is October 20, And, in The Americas, it's October, sorry. October 20 for EMEA and Americas and, October 22 for APJ. Yeah. Absolutely. Absolutely. So let me let me throw a question your way. And this one is around, Sophos CSO Advantage and integrating Sophos CSO, Advantage into, the services that MSPs are already delivering? You know, is this an opportunity for MSPs? Navida, love your thoughts on this one. Yeah. So so for for me... From a CISO Advantage point of view... My apologies. I lost my lost my track there. Yeah. For... So CISO Advantage is designed so that you can use... To use it to deliver your managed security service offering. So it's a tool that you can use to turn the strategy and CISO type activities you you do into a structured service. And as I said, as a billable service, it really makes a huge difference from those conversations that you're having to be able to monetize them and put them into into real terms. So you can integrate that into your practice however you you kind of... However works best for you. Great. Thank you. And just on the topic of CECO Advantage, we have had questions around the the licensing. So Sophos CISO Advantage is is actually available for two different types of licensing. So if you have a term business, and I know many do have a a term armed to your operations, it's nice very simply on a on a per user basis. For MSPs, it's life on a per customer basis. So a simple fixed price model per customer so you can use it to build clearly simply, a pricing model for you to take out to your, your clients. Brilliant. So, lots of discussion, Sally. I know you've been at the forefront of, of, some of some of these, you know, conversations around AI. There's a number of different differentiators that that that make Sophos difference to our competitors that really put us ahead of the game. What what is... What would you... What's your kind of view, as as sort of some of the key differentiators that put Sophos, or separate Sophos from from others in the market? Yeah. That is a really great question. And, of course, everybody is talking about AI. It's the top of, top of mind, subject for all the the the organizations that we collectively secure. So I would really give three key pillars that, enable you. as a MSP to stand out in the market in terms of the the, support security coverage you provide in this this AI world. So firstly, with Sophos Fusion, you have the industry's leading cyber defense system. No other provider has the breadth and depth of coverage. And importantly, most importantly, no one else has architected their, system to work together in the way that we have. So you have the connectivity between the solutions. You have all of the data from right across the 625,000 customers we defend coming in in real time into that unified data lake, so elevating protection automatically for all. So the fact that Sophos is the is the first to market with this in a breadth and depth of cyber defense system puts you in a in a poor position. I'd also lean into some of the unmatched protection capabilities we have specifically for the AI era threat. So now I was talking about, vulnerabilities, and we know that, discovery of vulnerabilities is one of the things that AI has really accelerated. Well, they can... It's accelerating the discovery of vulnerabilities. It's, accelerated the building of exploits to to take advantage of those vulnerabilities. But software standpoint is unique in that it stops the techniques adversaries use to exploit these vulnerabilities. It's defending all of your customers against vulnerabilities whether they've known, whether there's a patch for them that hasn't yet been applied, whether they haven't yet been discovered. This is a foundational level of defense. Now it's not a new capability. Those of you who've been Sophos partner for a while will know that we've had the exploit prevention capabilities in Sophos endpoint for for quite a long time. So it's really proven, really battle hardened, but it has never been more important in this AI era. So that unmatched protection, foundational defenses that you can give customers with software's endpoint, I think, is a massive differentiator for you against any other endpoint provider. And then the third point, I guess, the third pillar I lean on is is around AI defense, the ability to secure the AI solutions used across all the different lines of businesses that organizations have. The fact that it's integrated into, into the Sophos fusion system, It's connected with Sophos endpoint EDR, so it's taking that live telemetry. It's giving you the ability to see and to control and to demonstrate enforcement. It's all working together. It's not a separate console. It's not another element that you need to bolt on. It's built in. You know, it connects. It takes telemetry from from software's firewall, for example, as well. So it's really connecting the defenses. So that AI security control and governance is not a separate thing. It's integrated into to what you're already doing, which simplifies management for you, but also it gives our shared customers a much better AI defense experience. So there are lots of differentiators. I know your MSP team would love to to discuss more with you and and talk to the ones that are particularly relevant for for your market and your customers, but those would be the three pillars that I would say, the the defense system, the unmatched protection capabilities, and the soft plus AI defense solution, how it's integrated into the to the model you're already delivering. Brilliant. Thank you, Sally. That's that's great. That... That's a... That's three really solid points for everyone to take away there as well. One of the other points I think that has come up, and some of the questioning has been around the fact that with Sophos working with the likes of OpenAI, with Anthropic and others, how secure is our customer's data? What can what can MSPs say to their customers to assure them that they are not exposing their data to any sort of further attack as Yeah. And, really good point. You know, we we all see the see the news headlines. result. And, data security, data privacy, data control, it's been central to to our business for the full forty years that that we've been operating at Sophos. And our chief information security officer, our trust principles, they have built out detailed, documentation around our AI principles, for the AI models we build in house, the the AI we we use, in partnership with with external providers. We've got a lot of information on that on the trust center. So there's also an FAQ on the trust center. So, if I can encourage you to take a look after this summit, trust.sophos.com. Go and check out the the information there. If you have more questions, please come back to your team. This is a hot topic. This is an area that's moving fast. We want to make sure that you're equipped to be able to give your customers the the reassurance that they need and for them to be able to deploy AI, solutions with confidence. So do take a a look at the trust center information, and if you have more questions, then speak to your account team. Brilliant. Fabulous. Thank you, Sally. Thank you, Savannah. Appreciate it. Right. We will move on. So we've got the last session for, the afternoon, and thank you everyone for hanging in now. Hope you're all primed and ready to go. Some really, really good questions. Keep the questions coming in. They're they're superb, and we'll try and answer as many of those as we possibly can. As I said, quick reminder, go into the docs section. There is... There are... There's some phenomenal assets in there. There's exploits explained. There's a there's a note from our, CTO, John Peterson. There's the state of ransomware report, the state of... Sorry. The MSP perspectives report in there as well, and also how to, get into the Sophos, version 23 EAP as well. So please make yourself familiar with all the documentation that's going on there as well. We'll move on to the next session, which is how does all of this come together? How do we make this something tangible for you to now take to market, to deliver, to sell, to provide to your customers? And it gives me great pleasure to be able to introduce Chris Krellin, who's our VP for MSP product. I will hand it over to Chris. Alright. Welcome to our final session of the summit, and thank you again for spending your valuable time with us today. I'm Chris Krellan, vice president of product management for MSP here at Sophos, and I'm gonna be joined by some distinguished guests for this session. This session is called making it real, and I'm gonna do that in three ways. The first is the MSP landscape. Explore the underlying structural security challenges and strategies for AI era success. The second is Sophos Fusion. See it in action with a demo, including the AI defense experience. And third is the MSP experiences. Hear from your peers around the globe as to how they're optimizing for the AI era. Let's start by taking a look at the landscape in which you're operating. Most organizations today are are living below a line. It's called the poverty line. The poverty line is a strategic capability gap, a line below which an organization can't really be effectively secured. And there are four forces that push organizations beneath it. The first is money. Now as we all know, if you cannot afford the tools, the staff, or the services, your security suffers. You'll have gaps and holes that you just won't be able to cover. The second is expertise. Even with the money, you need the people who know how to use it well. Having tools that aren't set up correctly and so forth, they're not going to be of much use to anyone. The third is capability. Some organizations cannot implement the controls at all. And last is influence. Your defense does not end at the edge of your organization. Here's a shape, a nautilus shell. We've seen this shape before. It's called the golden spiral, and it grows by a single rule, a Fibonacci sequence. Every turn is larger than the last, but the shape never changes. It scales without ever starting over. Similarly, adding new disconnected security products does not proportionally strengthen an organization's security posture. It makes the size of the security estate bigger and the scope of what needs to be managed, but it doesn't actually change fundamentally how security works. It's more of the same, not a fresh approach. Omnia reports that the average SOC runs 11 security consoles. 11. Well, they said 10.9, but I rounded it to 11 because who has point nine of a console. Right? Gartner found that the average enterprise manages more than 45 security tools. Just adding more to your stack does not get you a smarter, better defense. You get more discreet tools and interfaces and management challenges to boot. The intelligence always stays trapped inside each tool. The endpoint never learns what the firewall saw. The The email security layer never tells the identity layer what it caught. Every tool learns alone. It's all silos. Nothing builds on what came before. That is what most organizations live with today. A pile of tools that don't talk to each other, throwing off more alerts than any team yours or your customers can deal with. So what we build at Sophos is Sophos Fusion. It grows another way. It compounds like the ratio exponentially. And businesses keep throwing money at the problem. The world spends 240,000,000,000, with a b, dollars a year on cybersecurity. It's nearly a $250,000,000,000. There's never been more tools, more vendors, or more dashboards for you to manage. And yet breaches keep rising in in frequency, in cost, and in impact. That gap between all that spending and the outcome is it fails to deliver is the problem that we at Sophos exist to solve in partnership with you. What's more? Get a load of this. This is the cybersecurity market. Every logo is a company. Every block is a category. Somewhere in here is the answer to a customer security problem. Good luck finding it. This is what buyers are up against, and I don't mean the small businesses with no security team. I mean the sophisticated buyers in the world that are struggling here. The ones with a CISO, a budget, and a staff. Even they cannot navigate this map. Even they cannot tell you which 15 of these logos they actually need, which ones overlap, and which ones will still be here in three years. This is the problem before the problem. Before a single threat ever lands, our customers are lost in the noise of an industry that sells complexity and cost it choice. The cybersecurity poverty line is not defined whether an organization has a CISO. That ratio, one CISO for every 10,000 organizations, which Jay shared earlier, just clearly illustrates the access problem that perpetuates it. Cybersecurity poverty line also is not defined by an organization's size. It just tends to impact smaller organizations more acutely. And it's not just defined by budget. Money is one of the forces, but I've seen well funded enterprise organizations sitting below that line, spending heavily on tools nobody has the expertise to operate. I've also seen SMB manufacturing companies that operate well above the line because they made deliberate, disciplined choices about how they run their program. So let me put... Say plainly what the poverty line actually is. It's the strategic security capability gap. It's the gap between owning security technology and being able to run it as a system to set it up correctly, watch it around the clock, measure whether it's working, and improve it over time. That is a strategic capability. That is the line, not the budget, not the size, not the org chart. It's whether you have the capability to turn security technology into an actual defense. And when you understand it in that way, you understand why almost everyone is below it, and you understand exactly what the opportunity is in the market. This is the challenge facing all organizations, and they have two options. They can try to address it themselves, and many larger enterprise organizations are well positioned to do so, or they can turn to a trusted partner for support, and that's where you come in. Let me share with you some insights from our latest MSP perspectives report based on a vendor agnostic survey we commissioned over 800 MSPs over across seven countries. First, 88% of MSPs say you're already doing that de facto CSO, role for your clients. The average MSP now holds the CSO role for 48% of their customer base, and 84% expect that responsibility to keep growing in the next twelve months. What this is saying is that organizations are already recognizing that even if they don't know what the term cybersecurity power line is, they know they need your help, and they know they haven't got the strategic capabilities in house. And it's also revealed that almost all MSPs, 99%, already provide some level of compliance services. The opportunity for growth here is huge. 58% of MSPs provide full program management, but only 6% provide a comprehensive service stack. And compliance is driving both compliance service demand and dictating investment and spend. Half of MSP's customers purchasing decisions are influenced by compliance demands, and a third are heavily influenced. That's a lot of CISO level management and reporting and a lot of compliance related activities, which takes up a huge amount of time. In fact, MSPs estimate that they'd save 53% of their time if they can manage their customer security posture, compliance management, and reporting activities via a single unified platform. 22% of MSPs said they would save more than 70% of their time. Think about that. With a single unified platform, you could slash your time to deliver in half while keeping your billings at the same level. You're essentially doubling the efficiency and the productivity of your time, doubling your revenue potential, or you could look at it as halving your costs. And at the same time, we also need to think about how we use AI within organizations to deliver our work, not security. According to the GTIA, 97% of IT service providers are already using AI inside their own operation, but just a quarter describe themselves as strategically driven. This is your opportunity. Against this big backdrop, we don't have one AI challenge. We collectively have three. Defending against AI enabled attacks as attackers are using LLMs to increase the speed, scale, and scope of attacks. Enabling your customers to leverage AI across their their lines of business, giving the visibility and control they need so they can stay secure and manage their costs because AI, as we know, ain't free while also being able to benefit from the advantages of AI. Using AI to accelerate your own business, increasing productivity and profitability while also enhancing your customers' outcomes. So So what can you do about it? We have here the MSP maturity curve, starting with technology operators focused on reactive IT price by activity, then evolving to risk managers where security, compliance, and resilience are at the core of your relationship. I expect many of you are probably right here right now. This is a good place to be starting. Productivity advisor is the next stage where you're able to provide advice on how organizations can improve the output per employee. The final, fourth stage is the strategic partner. This is where you're paid to manage business outcomes and change, not infrastructure. Typically takes about eighteen months to three years to go on this full journey. Think about where you fit and how you move along the curve. Fortunately, you have an accelerator, Sophos Fusion, and the Sophos security portfolio, including the new CISO advantage in AI defense. Every Sophos solution is part of the defense system, which makes every one of them a way in. So your customers with a single Sophos product are already inside the defense system and already benefiting from it today. And as you add additional products and services, you're moving further away from the concept of a stack and more into an integrated, carefully designed defense system where each of these components speak to one another. CECU Advantage, which we demoed earlier, gives you that single unified solution for managing security posture, compliance, and reporting. So you can save that 53% of your time and be driving strategy. AI defense enables you to see and control AI across your customers' environments. But enough of me talking about fusion and AI defense. Let's see it in action. As Sophos MSPs, you're responsible for multiple customers, each with different risks, priorities, and levels of security maturity. Securing customers in the AI era isn't about introducing more tools. AI is changing the threat landscape across identities, endpoints, network, security operations and the AI applications your customers are adopting. What makes it possible to address those challenges isn't a collection of disconnected products. It's a common cyber defense system that brings the capabilities, intelligence and context together. This is the Sophos Fusion in action from an MSP perspective. Let's start where you start in a view across your customer state. That's right. From here inside of the new partner dashboard, we can already see all of our customers. We can very quickly take a look at their health scores. We can see the alerts for all of your customers. And from here, we can move across our customer base and quickly identify the solution services and security information relevant to each customer. We'll be able to see all of the products currently in use. And once available, products such as CISO Advantage, which we demonstrated earlier, so we won't repeat that workflow. But what matters here is we can see it as part of the same wider Sophos MxP experience and license so... CISO Advantage, ITDR, and AI defense and next gen SIM when they are available. Let's take identity as our first example. Identity has become one of the most important attack services in the AI era as adversaries use AI and automation to accelerate social engineering, credential theft, account compromise, and privilege abuse. Getting started as straightforward as connecting the customer's Microsoft Entra ID or their on prem active directory environment. Once connected, we can begin with surfacing identity exposures and risks with your customers within minutes. From the identity dashboard, we can quickly identify what their risk score for the businesses. We can look at risk over time and even look at the top findings for the environment. The dark web intelligence will help identify compromised user accounts, and the deeper insight through the directory can really bring out issues that need attention. This is one of the simplest ways for you to start delivering value through a Sophos Fusion. Connect your customers, enter ID environment, uncover meaningful identity risk, and take those findings into a customer conversation. And we have some great news. Sophos ITDR is also now available as a standalone solution that makes identity security accessible to a broader range of customers, including those that may not be yet ready for a wider XDR MDR conversation. ITDR is one example of the wider Sophos fusion opportunity. Multiple solutions addressing different AI era risks supported by the same cyber defense system. Identity is a major AI challenge. The customers are also creating an entirely new attack service through their own adoption of AI. Now let's take a look at how MSP is going to help them address that. So imagine one of your customers comes to you and says, our employees are already using generative AI, but we don't know exactly which tools they're using, what information they may be sharing. What do we do? I don't even know what our policy should be. The customer understands the potential of AI, but doesn't understand the potential risk that comes with it. And that risk can't be understood or managed without visibility. That's where you, their MSP comes in. They need you to help define and deliver an appropriate AI security strategy. So where do you begin? A customer can leverage what they have already deployed. Customers using Sophos EDR, XDR, or MDR already have the required foundation for AI defense. For an existing customer, this extends the security environment they already manage rather than creating a completely separate operating model. With the AI defense dashboard, we can see the top AI apps in use, and we can see how that policy is helping them cover and protect their environments by seeing what's been allowed, what AIs are warned against, and what's being blocked. Additionally, looking through the dashboard, we can even identify who their top AI users are and what AIs they're currently consuming. For SOPOS endpoint customers, the AI conversation creates a clear opportunity to discuss and upgrade to EDR, XDR, or MDR. This helps you evolve your security offering for the AI era while building on the customer's existing Sophos investment. The customer's first question is usually the most basic one. What AI is actually being used across our business? Let's see how you'd answer this. Before the customer can decide what to allow, restrict, or investigate, they need to be able to understand what's actually happening. Which AI applications are employees using? How widely are they being adopted? And where could this... That usage, introduce risk? What information are they using? What are they sharing, etcetera? So let's take a look at the added visibility Sophos AI Defense provides to you. Here, you can see the AI services being accessed in the customer environment. We can identify where adoption is occurring, what applications are involved, and where activity may need closer attention. The goal isn't simply to produce a list. It is to give you enough context to help the customer understand their AI usage and make informed decisions. This changes the customer conversation. Instead of asking whether employees are using AI, you can show how AI is being used, the potential risks involved, and where clear policy may be required. That's insight many customers can't produce for themselves, and it gives you an immediate opportunity to lead. Visibility is the starting point, but the customer will immediately ask what they should do next. How do MSPs turn this insight into governance? Customers don't simply wanna know that AI is being used. They wanna benefit from AI without exposing the business to unacceptable risk. The answer isn't usually to block every AI application. It's to determine what should be approved, what should be monitored, and where strong controls are needed. So let's show how MSPs can take insight uncovered and turn it into action. You can work with the customer to distinguish between approved AI use, activity that requires monitoring, and use that should be restricted. Once that decision is made, you can translate it into practical policy rather than leaving it as guidance in a document. Sophos Fusion allows the AI defense solution to use the relevant Sophos control points across the customer environment to put that policy into practice. This is where you move from providing visibility to delivering strategic value. You're helping the customer decide how AI should be used, turning that decision into practical controls, and supporting the customer as its AI adoption evolves. Earlier, we talked about moving from the security provider to being a strategic partner. This is what it looks like in practice. You at this point as the MSP have helped the customer understand its AI usage and put appropriate controls in place. The next question is how it demonstrates that value over time. A managed service needs to show continuing value. You've identified the issue and helped the customer respond. How do you now show what's changed, where the risk remains, and what it recommends next? You can use these views to show the customer the current state of AI adoption, which policies are in effect, and where further attention may be needed. This provides evidence for a regular customer review where you can revisit usage, recommend adjustments, and demonstrate how the service is evolving. Customers don't buy dashboards. They buy outcomes and competence. This creates an ongoing engagement model, review how AI usage is changing, assessing whether the customer's policy still fit, recommend the next action, and demonstrate the value being delivered. We know that demonstrating the value is one of the most important parts of your job and allows you to retain your customers and grow them over time. That is how a product capability becomes a repeatable managed service. And that service doesn't just exist in isolation. Once you understand the customer's AI usage, this often uncovers wider requirements across the customer environment. The initial question was, how are our employees using AI? But once you start answering that question, then conversation naturally becomes broader. The customer may need greater control at the endpoint, in the browser, across the network, It may need stronger security operations to detect and respond to threats. And it may uncover identity or broader exposure risks that require attention. Each of those requirements supports the same customer objective, adopt AI while reducing your cyber risk associated with it. Every customer can begin with the capability it needs today and extend its protection as requirements evolve. AI defense can work with relevant Sophos control points to expand visibility and control across the customer environment. CISO Advantage can help the MSP assess the customer's wider security program and identify priorities. You as their MSP can then use the other solutions powered by Sophos Fusion to address those needs. Rather than introducing other disconnected operating model for every requirement, you continue building on Sophos Fusion. Through the use of Sophos AI defense, which we just discussed, you can evaluate how AI is being used in the environment today and take action. With our MDR, you have visibility into security than the happenings in the customer's environment. CISO Advantage, which was discussed earlier, helps set the path forward for managing that customer. Through our server and endpoint protection, we have visibility into the client and protect them at the device level. Our identity protection looks to how identities are being used and the security for those identities. Our networking products such as firewall, the switches, and wireless allow for infrastructure to be connected into Sophos Central and give you that single point of management. And our workspace protection with our DNS protection to monitor every request going out in our ZTNA for remote access provide a secure solution for users on the go. And, of course, don't forget our messaging. The email security allows you to scan all of those incoming emails where most threats begin these days and Phish Threat to help users better understand and learn about threats coming into their environment through email. Alright. As you know better than anyone, every customer starts somewhere different. One may begin with identity risk, another with AI governance, and another with security operations or strategic assessment. The value of Sophos fusion is that those starting points can become part of a broader connected customer journey. For Sophos MSPs, that creates additional services, recurring engagement, wider customer coverage, and a stronger long term relationship with your customer. And one customer conversation could become a roadmap to the customer security program, and that is a growth path for you. So let's step back from the individual workflows and look at what, MSPs have actually achieved through Sophos Fusion. We started with the identity security, one of the most important attack services in the AI era and showed how an MSP can begin uncovering customer risk very quickly with Sophos ITDR. We then followed a customer's AI question from initial discovery through visibility and governance to ongoing service delivery. And we showed how that first customer need can open the door to broader security services across endpoint, browser, network, security operations, identity and strategic risk management. Earlier in the summit, we introduced three areas where MSPs need to address: AI for security, security for AI, and security from AI. Sophos AI defense helps MSPs deliver security for AI. Sophos ITDR and the broader portfolio deliver security from AI, helping protect customers from threats that adversaries can accelerate and scale with AI. And across endpoint network, XDR, MDR, and the wider solution set, Sophos applies AI to strengthen customer defenses and security operations. The critical point is that you can continue building on the same Sophos Fusion cyber defense system as the customer's requirements evolve. Your customer can start with the immediate need while you retain the opportunity to extend protection and services over time. Earlier, we talked about hearing the noise, writing the score, and building the orchestra. What you've just seen is the performance, and I hope you thought it was a good one. In MSP managing security across its customer base, identifying emerging risks, deploying valuable services quickly, turning insights into action, improving continuing value, and expanding customer protection over time. Bringing it all together with Sophos Fusion, you can secure your customers, strengthen your relationships, and build your MSP business for the AI era. Hopefully, that has really started bringing everything to life for you. Now I I wanna speak for a moment about growth and where the growth is right now in this new AI era. Getting practical, I have five main areas I'd like to suggest to you. Cyber resilience, enabling organizations to build resilience to AI era threats. Big focus areas here are MDR. Twenty four seven machine speed response is essential. If you don't deliver in house, have our team do it for you. No one else secures more MSP clients with MDR, and no one knows MSP clients better than Sophos. The second is identity, the new frontier. Identity security needs to be front and central to your customers' defenses. And the third is network security. Robert talked earlier about how AI has increased the importance of the network. Your customers need performance, and they need defense. Second overall is CISO style risk management services, providing the strategic capabilities and direction businesses need while ensuring compliance with regulatory obligations. As I said earlier, this is also the gateway to additional investments to meet compliance needs. Third is AI res... Readiness and governance. Take control of AI. Enable customers to see it and secure it. Fourth is verticals. Many of you are seeing great success focusing on particular verticals, enabling you to provide tailored high value support to your customers' specific needs. And lastly, outcome based packaging, moving to a model where pricing is based on outcomes, not hours. So that's five areas that I suggest you explore. But let's now hear from your peers to see where they are and where they see the opportunities ahead and how they're focusing on their business. We're gonna go around the world starting with Shane Jordan from CisGen Solutions Group in Canada, Then we'll hear from Eugene Klassen from seven c in South Africa, and then Ashley Darwin from Addits in Australia. Hi. I'm Shane Jordan, the vice president of service delivery at CisGN Solutions Group, based here in Calgary, Alberta, Canada. We service primarily small to medium sized businesses, supporting over 185 customers actually globally around the world. We support everything from day to day IT operations, cloud services, cybersecurity, AI adoption, and strategic planning for our customers. Really at CisGN our approach is simple. We focus on outcomes, not just technology. We want to be sure our customers are secure, productive, positioned for growth. And that's where strong partnerships like the one we have with Sophos help us deliver real value. It's a simple problem, but you know, it's an extensive problem. And that's really how to stay ahead of, you know, increasingly sophisticated cybersecurity threats without building an expensive internal security operations. So, they're concerned about ransomware, identity compromise, phishing and compliance risks. And they want the confidence that threats are being monitored and responded to 20 fourseven. So, at CisGN that's why we partnered with Sophos to help deliver those outcomes through combined partnership that ensures Sophos MDR capabilities are giving our customers the protection and peace of mind that they're looking for today. We're really seeing AI drive two conversations at once. On one hand, customers are excited about the opportunity. They're looking at tools like Microsoft Copilot, other AI solutions to help employees work more efficiently, automate repetitive tasks and improve customer experiences and get more value from the data they have today. However, on the other hand, AI is creating a whole new set of security concerns is what we're seeing. You know, customers are asking us questions like how do we protect sensitive data for using AI? How do we govern AI usage? How do we prevent employees from accidentally exposing company information? And how do we defend obviously against the increasing attacks that are coming through AI? So at Cision, we're really focused on helping customers embrace AI responsibly. So we're working with customers today and organizations to build AI strategies that are going to help establish governance, security controls, and identify practical use cases that deliver real value for our customers. So, we're investing heavily ourselves at Cision and AI adoption. And what's becoming clear is, you know, AI and cybersecurity are certainly closely connected and really driven in parallel. So especially as threats evolve, having that strong security foundation in place and a great partner like Sophos, is really going to help us improve visibility, monitoring, detection, and ensure that our customers move forward with AI in a very safe fashion. Yeah, I think for me, the biggest opportunity in AI is just helping customers innovate with confidence. Everyone's talking about AI. You know, it's the buzzword that's out there. But at the end of the day, customers aren't buying AI for the sake of AI. They're looking for better productivity, better customer experiences, and really better business outcomes. So, our role at Cision is to help them get there and identify real world use cases that are going to help drive change within the organization. But really tied closely to that is ensuring that you have the right governance and security controls in place. And that's where Sophos has really become a critical part of that conversation, ensuring that that strong security foundation is in place as we move forward with customers in their AI journey. Sophos has really become an extension of our team. Their MDR capabilities allow us to provide 20 fourseven monitoring, threat detection, and response for customers without having to build those capabilities ourselves. And as we look to grow our security and AI practices, Sophos helps us scale, really deliver better outcomes to our customers, and give customers the confidence that they can continue to innovate securely, and help us deliver really enterprise level security with responsiveness and that personal touch that our customers expect from Cision. So Sophos has truly become an extension of our team and a very valuable partner. I think the future belongs to MSPs that can combine trusted advice, strong security and business strategy. Those three key things are mission critical moving forward. And I do feel that's really what our partnership with Sophos helps us deliver as an extension, like I said, of our current team today. I would say don't treat Sophos as a product provider. Again where I've said they're an extension of our team that's truly what they are. Sophos has really helped us succeed in leveraging the full relationship not just the technology side. So whether it's MDR, security expertise, threat response, or even just strategic guidance, you know, we leverage and rely upon Sophos to help ensure we're delivering those capabilities to our customers day in and day out. Certainly, we'd want to say thanks to Sophos for a great partnership. We've grown our cybersecurity practice tremendously. And as I mentioned before, the way that cybersecurity and AI need to move hand in hand and in lockstep to keep customers safe and drive positive business outcomes, we're extremely proud to be a platinum Sophos partner. So seven c, we're based in Johannesburg with a presence throughout South Africa. We... Either through our partner network or our own presence, brick and mortar. Our focus is primarily on the SME market, so 20 to 200 users, where we specialize in acting as companies' trusted advisers, ensuring scalable, secure, and cost effective growth for our clients. So we've primarily seen companies working to meet more and more compliance requirements, especially from larger businesses they might be working with. So many companies, you know, they may have been aware of cybersecurity and GRC risks, but often this has been seen as something, you know, for big business. But obviously, this is not the case anymore. I see a lot of value in allowing users to make the ideas that they have, but lack the skill to implement reality. Now, obviously, doing that in a safe and responsible manner is, you know, paramount to avoid being in the news like some businesses have been recently. But, you know, longer term, we're all very excited for AGI and all those types of things. But I think like most revolutions, the true value will be in the in the unexciting routine spaces, such as, you know, validation of documents, boilerplate prep work, that type of thing. We are a very, very long time fan of Sophos. I checked the other day. I think we're approaching almost a decade of working with Sophos. We are very excited to explore the new vCISO products, along with our continuing build out of MDR across our client base. So we want to ensure that no matter where our customers are, no matter when they're working, that they are secure and looked after. As a trusted advisor, our primary role has been to separate hype from reality and finding opportunities where AI can really bring value and ROI to our clients. For our customers, this has been primarily helping them understand policy, finding training, been providing the foundations such as clean data and having the right solutions in place for AI to work as... At its best. From a seven c standpoint, we've been using it to give nontechnical departments access to fast research assistance with wording on, sales plays and quotes, etcetera, etcetera. From a technical perspective, we've been mostly building next generation tooling for ourselves, reducing administrative burdens and providing insights faster than ever. We see ourselves as a key education partner to the broader SME market, and our upcoming webinar is focused on AI, how to work with it effectively within the business and educate the business on the Microsoft Copilot product. So I think the ones that'll be the most successful is that... Is the ones that approach our new AI driven world with a sober view that keeps focused on the basic principles of our jobs, which is providing our customers and our clients with technology that solves business needs and brings real security, data backup, recovery, and most importantly, advisory value to our clients. You know, it's added a whole new layer of complexity into the IT environment with new potential threats that, you know, businesses have never faced before. So from our side, our priority and... Is to to be that trusted adviser, be someone a customer can count on and answer the questions they might have, to navigate this thing that seems to change almost every fifteen seconds these days. So it's up to us to stay ahead of that and keep our clients safe and secure. Our customer success will always be our success. I'm Ashley. I'm the managing director of Adits. Adits is an MSP based in, Queensland in Australia. And our vertical customer market is around non for profits and social services and medical. Yeah. I think the biggest questions we get from our customers is around governance, risk, and compliance. I think our customers, particularly here in Australia, with changes to the privacy legislation, we get the most questions about, the private... Their privacy legislation as well as their regulation in their particular industry vertical as well. I think what we've seen, in our customer base is there is a bigger focus on cybersecurity. I think, in the general media, we see we see it a lot more. So from a CEO and board level, the questions are coming, back to us, and they're asking to be educated in that space. And we see that they're asking about what risk the organization has, and they're asking us to mitigate that risk. Yeah. I think as organizations or our customer bases are starting to use AI or wanting to use AI, we're we're actually taking back a step and making sure that they understand where their information is, what users are using what AI, and then making sure that we provide an AI readiness assessment that has all the information there so they can make an informed decision before they go and do anything. For an MSP, I think firstly, it comes down to education, where education... Educating the customer base on what's possible and then asking them what their... What business problem they're trying to solve. And once they've identified that, we're working with them to to create a solution that best solves the problem and that fits in the business in in a way that's going to be beneficial for them. Part of that is success, is around Sophos' MDR, platform. I think the exciting thing for us is the next gen SIEM, that Sophos is offering, which is part of their new Sophos Fusion. Yeah. I think the MSP landscape is changing rapidly. I think there's two things that our customer everybody's customer base is is looking for one is around advisory around digital transformation and AI, and I think the other other one is around governance, risk and compliance. I think there's boards and CEOs that, understand their risk and wanna mitigate that and are looking to MSPs to do that for them. I think in a world where CEOs and boards are looking at their governance risk compliance and turning to the MSP to secure them or to secure their cyber, I think partnering with them, I would... With the MDR team is, is a definite. And I think with the, next gen scene, I think that's only gonna protect and make people more confident with MSPs in general. Thank you, Shane, Eugene, and Ashley. How does their experience and what they're planning to do align with your own organization? We'd love to know. This brings us to the the end of the session, and I'd like to take us back to where we started in AI. We talked a lot about AI today, and the final question is, how do you win the AI conversation? One, enable. Don't fear. For most of your customers, AI is scary. This is where you are the strategic leader. Educate them on AI and enable them on it. Your customer staff are adopting AI regardless of what their security team says. The winning position is we can move fast on AI because we know how to do it securely. Sophos is the reason you can say that. Secondly, expose the gaps. Ask them who is using AI within their organization right now. They probably can't answer. Ask them how they are protected from AI enabled threats. They likely don't know that either, but you can get them clear real time answers. Start these conversations now because they take time to turn into action. Third, meet AI threats head on. AI enabled threats are complex and multistage. They thrive in the gaps between defenses, taking advantage of the gaps between security products. Leave attackers no place to hide by connecting your customers defenses and enabling them to respond as one at machine speed via a unified connected approach where humans remain accountable. So that brings us to the end of today's summit. As you've seen, we've built the industry's most comprehensive AI native defense system, Sophos Fusion. This is how you secure the AI era. This is how you build the MSP practice of the AI era. The road map is loaded. Each new solution expands what you can sell and deepens why customers stay. So now let's go win together. Thank you. Great. Thank you very Yes. That was a phenomenal session. That was, really informative, and, I hope you all got, a lot out of that. And thank you everyone for for joining on the call and, sticking with us. Now given, the... There's been a huge number of, questions that have continued to come through, so I wanna make sure we answer those as many of those live as we can. And I've got Sally and Savannah with me again to help us to, to answer those. So, without, further ado, because I do appreciate you've all been here for quite some time, let's get, let's get stuck in. So, first of all, for you, Sally, it's a... Got a question here. It says, with AI based attacks increasing, why are customers not inclined to switch to NDR services? Brilliant question. What... What's your what's your thinking on that? Yeah. This is a great question, and, actually, we are seeing a lot of them to SP seeing great success in, switching customers to to MDR, particularly in light of the, the AI challenges that are around them. So if you're looking to help explain to customers why it makes a whole ton of sense for them to to move, to the MDR service, I suggest you focus on those three key areas that AI has impacted threats, speed, scale, scope. So AI attacks can move faster than, you know, we even imagined, you know, a few years ago. With the softness MDR service, you've got that eighty nine seconds from just detecting something's happening to resolving it. So faster than any of us could do individually. So it's the level of, you know, protect... Speed of protection that organizations need. Also, the scale, you know, huge, expansion in the the number of attacks that are out there. MDR again is is optimally positioned to deal with that. But probably the biggest one is scope. So with, AI, it's now much easier for adversaries to to do those complex, those multilayered attacks where they're they're touching different parts of the environment. And what you really need is a solution that can join the dots, can see all the pieces, can bring them together. You know, Barbara shared a a great stat around the fact that often the firewall is triggering a a... An alert that then is the hallmark of something that then goes on to be a ransomware encryption event. So if you can pull together these triggers, so, okay, the firewall is seeing this thing, and the endpoint is seeing this thing. And, you know, we got this from, from the the Microsoft telemetry. The the MDR services optimally positioned to pull all of these signals together to see the collective picture and then to put in the the the defenses they need. So I think you've got a really strong case with, the AI era, with the AI threat to help organizations understand why they need this, specialist coverage, why they need the 247 support. And it also, for you as the MSP, enables you to kind of relax knowing that that we've, we've got it covered. So, yes, so that that would be my suggestion. I see it actually as a big accelerator of MDR for you all. Yeah. Absolutely. Speed, scale, scope. I I think the the the message really resonates, I think, with a lot of the MSPs out there. And I think it's good that we're now able to capture that within the fusion, portfolio overall. So, that's that's, that's really great. I have a question, actually for... I'm gonna put one out to Savannah, for the minute. There's there's one here which has come in with regards to CSAID Vantage. So, Savannah, is CECI Advantage replacing Sophos pen testing? What what do you... What can you tell us about that? No. So CISA Advantage is not replacing soft post pen testing. CISA Advantage is a brand new solution. As we've pared through this, through the series today, it helps partners, customers deliver CISO level strategy and compliance. Pest... Pen testing is still available through our expanded professional services offering there. Fantastic. Brilliant. So, so pen testing isn't going anywhere. It's still there. CISO Advantage is in addition to... It is a completely different, offering altogether. It is the virtual CISO offering along with GRC. And, again, kind of bringing that all together, it it it kind of puts together not only your compliance element, where your risks and where your exposures are, but then how you then how you then build your portfolio or your Sophos defense system to address those gaps and to identify the high risks, the low risks, where you want your customers to spend, how much they should be spending, over what period of time. And I think I've said it a few times. Again, a great revenue stream for, for yourselves. There was also one other question that came in. I think, if I get your name right, Nanyo, sent in the question, and I know you're super keen to know more about CSO Advantage Plus. Sally, what can you share with us with regards to CSO Advantage Plus? Yeah. So CISO Advantage Plus is going to be an additional license option that will become available to you within the kind of second calendar quarter of next year. So initially, we're launching Sophos CISO Advantage. Advantage plus will be an additional option for you that's going to extend the offering by including continual compliance monitoring so that you'll get an alert whenever a customer falls out of compliance. So it's a further extension and further expansion of the offering. I think it's gonna be really powerful, really great addition. So we're working very hard to to to build it right now. We're excited to to share for you a lot more depth of detail, as. we start 2027. And and for for everyone that wants to know more about... So there's a lot of the features and trials and things that we've been talking about for existing customers to explore. So whether that's Sophos AI defense or CSO Advantage, for MSPs, the best way for you to explore a lot of these new solutions will be to, go through LFR licensing. So we want partners to get hands on experience in your own environment, get familiar with it, get down and dirty with the platform, understand where... What you need and how you can really start start understanding what what it has to offer your customers and what it can really do to drive your business, helps you to build confidence and also to build those all important customer use cases and service lines for yourself going forward as well. And then I think we've got one more question, which is around, again, the migration to Sophos Fusion. Is it only a tech step, or do we need to upgrade licenses and have additional costs? So I'll I'll cover that one off. Actually, there's there's there's no licensing charges or additional costs for Sophos Fusion architecture upgrade. Sophos Fusion is the cyber defense system. It's the architecture that powers all of the Sophos solutions. So it's not a separate solution or SKU. Sally, anything again that you want to add around that or to cover that off? You've said it brilliantly. Thank you, Naveed. Just... We're really excited to be upgrading you or migrating you all to to the new architecture. This is the the foundation, on which the the softwares portfolio is built. So reach out to your account team if you have any questions. Fantastic. Thank you, Sally. Thank you, Savannah. Appreciate your time. Thank you everyone on the call as well. There's a huge amount of information that we shared with you this afternoon or this morning. We really appreciate you to, having stuck around and listened to all of it through. Ultimately, this is all for you. This is for you as our partners, our valued partners, who we want to increase revenue with, drive growth, and really accelerate our market share in whichever market you are, be that central, north, south, and emerging. We are here to help you to build and grow your MSP service. There is a mention that I do wanna put out here. We did an MSP accelerator course, which was about two weeks ago, which was there purely to show you how to build, grow, develop, manage your MSP service lines. And that's everything from creating the actual offering itself, to recruitment, to people, to quotas, to the the full shebang, and this is built... Sophos' MSP line is built there particularly for you to be able to take advantage of not only the methodology, the business methodology, but then the technology that that lays on top of that. The delivery, the value, the the customer and customization that is provided comes from you, and that's where the value is. So please continue to to look into the partner portal. Make sure you spend time on part... On Sophos Academy. Have a look at the courses that are there. Test yourselves. Push yourselves. There's a lot of information on there. Explore new solutions. Explore some of the places that you may not have seen as conventional, sort of typical, service lines that you would have delivered in other, types. So I I strongly suggest you do that. Once again, thank you all for your time. Please reach out. There is still that request a callback. I've always wanted to do that. Request a callback, button. Please make sure that you do click that. We would love to get in touch with you. We'd love to take the conversation further and, as I said, develop the... Your business plan into the next fiscal year. So with that, thank you to all of our speakers. Thank you to all of our guests. More importantly, thank you to all of you as attendees. We will speak to you hopefully in the coming weeks. Thanks again.