Sophos expands global cyber clout with Arco Cyber acquisition

By Chinenye Anuforo

Sophos has acquired United Kingdom-based cybersecurity assurance firm Arco Cyber in a strategic move aimed at addressing the growing shortage of executive-level cybersecurity leadership across organisations worldwide, as businesses face intensifying regulatory scrutiny and increasingly complex cyber threats.

The transaction is expected to broaden access to artificial intelligence–driven cybersecurity governance beyond large enterprises, enabling organisations without dedicated Chief Information Security Officers (CISOs) to gain clearer oversight of cyber risk, compliance exposure and the real-world effectiveness of their security controls. Industry estimates indicate that while more than 359 million organisations operate globally, fewer than 32,000 employ a CISO, leaving the vast majority without formal executive stewardship of cybersecurity strategy.

Sophos said the acquisition strengthens its long-term shift from a traditional focus on threat detection and incident response toward continuous assurance, governance and measurable risk reduction. Central to this strategy is a framework the company describes as Sophos CISO Advantage, which combines agentic artificial intelligence, integrated security platforms and human expertise delivered through managed service providers and managed security service providers to replicate the strategic judgment and operational discipline typically associated with experienced security executives.

Advances in agentic and AI-assisted systems are making it increasingly possible for organisations to evaluate the real-time performance of their security controls while maintaining human oversight and accountability, an evolution analysts say reflects changing expectations from corporate boards, regulators and insurers that now demand demonstrable evidence that cybersecurity investments are materially reducing risk rather than simply generating operational activity.

Arco Cyber contributes capabilities designed to continuously validate control effectiveness, align security measures with recognised risk and compliance frameworks, and generate executive-ready insight to support faster and more defensible decision-making. Sophos Chief Executive Officer Joe Levy said the cybersecurity market is not short of technical tools but often lacks clarity around governance and measurable outcomes, adding that Arco Cyber’s platform provides accountability and proof that strengthen organisations’ ability to simplify compliance and manage cyber risk with confidence.

Industry analysts note that cybersecurity is undergoing a structural transition from activity-based monitoring toward impact-driven governance, as organisations face mounting pressure to demonstrate resilience against cyber threats. Research from IDC indicates that platforms integrating detection and response with assurance, advisory capability and risk-based measurement are becoming increasingly aligned with how organisations manage operational, regulatory and financial exposure.

Sophos expects managed service providers and managed security service providers to play a central role in scaling these capabilities, particularly for mid-sized organisations that rely on external partners for day-to-day cybersecurity operations. Embedding AI-driven governance and continuous assurance into partner-delivered services could enable those providers to evolve from technology operators into strategic advisers capable of delivering CISO-level leadership as an ongoing service.

For organisations that already employ security leaders, the combined platform is intended to provide a more integrated approach to tracking risk, measuring programme effectiveness and communicating outcomes to senior stakeholders. For those without such leadership, the system is designed to deliver structured guidance that supports prioritisation of security investments, justification of decisions and stronger control over cyber risk exposure.

Arco Cyber will operate as a dedicated team within Sophos, with its technology integrated into Sophos Central, the company’s unified cybersecurity platform that delivers advisory services, managed detection and response and partner-enabled security operations. Sophos currently provides cybersecurity protection to more than 600,000 organisations globally through a combination of machine learning, automation, real-time threat intelligence and human-led monitoring.

The acquisition reflects a broader shift within the cybersecurity industry from reactive defence against individual attacks toward continuous governance of organisational risk, as artificial intelligence increasingly enables executive-level security oversight to be delivered at scale across the global business environment.