In 2024, we turned one of many first organizations to decide to CISA’s Safe by Design initiative. Aligned with our core organizational values round transparency, Safe by Design has been a guiding drive as we regularly consider and enhance our safety practices.
We not too long ago handed the one-year anniversary of publishing our pledges for enchancment and want to publicly share the progress we now have made towards the seven core pillars of the Safe by Design framework.
I’m pleased with the progress we’ve made this 12 months however, after all, plans change and we haven’t fully-realized each purpose but. So count on additional updates and, very quickly, a contemporary set of further commits for the 12 months forward.
Multi-factor authentication (MFA)
Our 2024 pledge:
We pledge to launch passkey help in Sophos Central and publish adoption statistics for this stronger MFA mechanism.
How did we do?
In November 2024, we launched passkey help to all prospects utilizing Sophos Central. This strategic step was geared toward enhancing authentication safety via a phishing-resistant, passwordless login expertise. Since its launch in December 2024, we’ve seen robust adoption, with over 20% of all authentications to Central now using passkeys.
Along with launching passkey help, we went a step additional and now stop the usage of legacy MFA mechanisms resembling SMS. Customers of Central who depend on these legacy mechanisms are required to enrol in both a Time-based One-Time Password (TOTP) or passkey-based MFA throughout their subsequent login.
Determine 1: Adoption of Sophos Central MFA mechanisms between December 2024 and July 2025
Default passwords
Our 2024 pledge:
We pledge to proceed to disallow default credentials in all present and future services.
How did we do?
We now have maintained this design precept and can proceed to take action in our product growth. Sophos merchandise generate robust distinctive credentials, or require customers to supply advanced passwords upon setup, to assist cut back the probability of unauthorized entry.
Lowering complete courses of vulnerability
Our 2024 pledge:
In Sophos Firewall v21 (SFOS v21), we pledge to containerize key companies associated to Central administration so as to add further belief boundaries and workload isolation. Moreover, SFOS v22 will embody an intensive structure redesign, which can higher containerize the Sophos Firewall management airplane, additional decreasing the probability and influence of RCE vulnerabilities.
How did we do?
We’re taking a risk-based prioritized strategy to containerized workloads and have supplied higher workload isolation within the Sophos Firewall. Beginning with an important and uncovered companies, the releases of SFOS v21 and SFOS v21.5 included the primary of those enhancements . We’ll share particulars of the progress we’re making with the Sophos Firewall management airplane rearchitecture for SFOS v22 in a follow-up article, because it received’t be launched till later in 2025.
Safety patches
Our 2024 pledge:
Working the most recent firewall firmware model affords further safety advantages past receiving safety hotfixes by default. With this in thoughts, we pledge to launch a function by September 2025 that permits prospects to robotically schedule Sophos Firewall (SFOS) firmware updates.
How did we do?
Sophos plans to incorporate the power to robotically schedule firmware updates with the discharge of SFOS v22 when it’s launched later in 2025. Serving to our prospects hold their Sophos Firewall firmware updated is a precedence to us to assist hold them safe. At the moment, 99.41% of our prospects’ firewalls profit from robotically receiving OS-level hotfixes as they’re launched, because of the large adoption of our computerized hotfix deployment function.
Vulnerability disclosure coverage
Our 2024 pledges:
Enhance transparency and add to collective business information by publishing weblog posts that assessment findings and classes discovered from our vulnerability disclosure program
Enhance the utmost reward accessible to safety researchers.
How did we do?
Since our final publish in June 2024, we now have continued to put money into our public bug bounty program and the nice work that researchers share with us. This 12 months alone we now have reviewed greater than 800 bug bounty submissions for Sophos merchandise. We now have rewarded over $500,000 USD to the researcher neighborhood since we began this system again in December 2017 . As we speak, Sophos ranks among the many prime Bugcrowd distributors providing the very best rewards per legitimate discovering.
To assist incentivize and enhance the probability of discovering vital vulnerabilities which may influence Sophos merchandise, we now have made a couple of key enhancements this 12 months which align to our pledges:
- We elevated the utmost reward attainable for our Home windows Intercept X product by $20,000 USD; researchers can now earn $80,000 USD for a P1 submission
- We added a brand new reward which pays as much as $50,000 USD for a P1 discovering in Central
- We prolonged our premium bug bounty scope to incorporate financial rewards for legitimate vulnerabilities recognized in Taegis and Redcloak, following Sophos’ acquisition of Secureworks earlier in 2025.
We plan to share insights and classes discovered from the bug bounty program in a follow-up publish later this 12 months.
CVEs
Our 2024 pledge:
We pledge to increase our inside processes to persistently publish exterior CVEs for all recognized inside vulnerabilities of a severity of excessive or vital in our merchandise.
How did we do?
We now have met this pledge by increasing our inside processes to make sure that any vulnerability recognized internally and assessed as excessive or vital severity is ready for exterior CVE publication. Though no vulnerabilities have but been recognized which meet this threshold for publication, the up to date processes are totally in place and able to help constant and clear disclosure going ahead.
Transparently publishing CVEs for internally found points helps our prospects higher perceive the safety posture of our merchandise, helps knowledgeable decision-making, and displays our dedication to business greatest practices.
Proof of intrusions
Our 2024 pledge:
We pledge to supply further integration capabilities in Sophos Central to simplify the ingestion of audit logs into third events, with goal implementation previous to July 2025.
How did we do?
Whereas we now have made foundational progress towards this purpose, we’ve needed to modify the timeline to mirror the numerous organizational adjustments and new product alternatives ensuing from our acquisition of Secureworks earlier in 2025.
We stay totally dedicated to this pledge and can proceed to supply updates as we roll out enhancements.
Having reviewed our progress towards the commitments we made final 12 months, we’re now targeted on the street forward. Within the close to future, we’ll share the up to date pledges we’re making for the approaching 12 months— constructing on what we’ve discovered, the place we’ve superior, and the place we nonetheless have work to do. Our mission stays the identical: to repeatedly strengthen the safety, transparency, and trustworthiness of our merchandise, in alignment with the Safe by Design ideas.
