In 2024, we turned one of many first organizations to decide to CISA’s Safe by Design initiative. Aligned with our core organizational values round transparency, Safe by Design has been a guiding power as we regularly consider and enhance our safety practices.
We lately handed the one-year anniversary of publishing our pledges for enchancment and want to publicly share the progress we’ve got made in opposition to the seven core pillars of the Safe by Design framework.
I’m happy with the progress we’ve made this 12 months however, after all, plans change and we haven’t fully-realized each aim but. So count on additional updates and, very quickly, a recent set of further commits for the 12 months forward.
Multi-factor authentication (MFA)
Our 2024 pledge:
We pledge to launch passkey help in Sophos Central and publish adoption statistics for this stronger MFA mechanism.
How did we do?
In November 2024, we launched passkey help to all prospects utilizing Sophos Central. This strategic step was geared toward enhancing authentication safety by a phishing-resistant, passwordless login expertise. Since its launch in December 2024, we’ve seen robust adoption, with over 20% of all authentications to Central now using passkeys.
Along with launching passkey help, we went a step additional and now forestall the usage of legacy MFA mechanisms resembling SMS. Customers of Central who depend on these legacy mechanisms are required to enrol in both a Time-based One-Time Password (TOTP) or passkey-based MFA throughout their subsequent login.
Determine 1: Adoption of Sophos Central MFA mechanisms between December 2024 and July 2025
Default passwords
Our 2024 pledge:
We pledge to proceed to disallow default credentials in all present and future services.
How did we do?
Now we have maintained this design precept and can proceed to take action in our product growth. Sophos merchandise generate robust distinctive credentials, or require customers to supply advanced passwords upon setup, to assist scale back the probability of unauthorized entry.
Decreasing total courses of vulnerability
Our 2024 pledge:
In Sophos Firewall v21 (SFOS v21), we pledge to containerize key companies associated to Central administration so as to add further belief boundaries and workload isolation. Moreover, SFOS v22 will embrace an in depth structure redesign, which can higher containerize the Sophos Firewall management aircraft, additional decreasing the probability and influence of RCE vulnerabilities.
How did we do?
We’re taking a risk-based prioritized method to containerized workloads and have supplied higher workload isolation within the Sophos Firewall. Beginning with an important and uncovered companies, the releases of SFOS v21 and SFOS v21.5 included the primary of those enhancements . We are going to share particulars of the progress we’re making with the Sophos Firewall management aircraft rearchitecture for SFOS v22 in a follow-up article, because it gained’t be launched till later in 2025.
Safety patches
Our 2024 pledge:
Working the most recent firewall firmware model affords further safety advantages past receiving safety hotfixes by default. With this in thoughts, we pledge to launch a function by September 2025 that permits prospects to routinely schedule Sophos Firewall (SFOS) firmware updates.
How did we do?
Sophos plans to incorporate the flexibility to routinely schedule firmware updates with the discharge of SFOS v22 when it’s launched later in 2025. Serving to our prospects preserve their Sophos Firewall firmware updated is a precedence to us to assist preserve them safe. At present, 99.41% of our prospects’ firewalls profit from routinely receiving OS-level hotfixes as they’re launched, because of the extensive adoption of our computerized hotfix deployment function.
Vulnerability disclosure coverage
Our 2024 pledges:
-
Enhance transparency and add to collective business data by publishing weblog posts that overview findings and classes discovered from our vulnerability disclosure program
-
Enhance the utmost reward obtainable to safety researchers.
How did we do?
Since our final publish in June 2024, we’ve got continued to spend money on our public bug bounty program and the nice work that researchers share with us. This 12 months alone we’ve got reviewed greater than 800 bug bounty submissions for Sophos merchandise. Now we have rewarded over $500,000 USD to the researcher group since we began this system again in December 2017 . As we speak, Sophos ranks among the many prime Bugcrowd distributors providing the very best rewards per legitimate discovering.
To assist incentivize and improve the probability of discovering important vulnerabilities which may influence Sophos merchandise, we’ve got made just a few key enhancements this 12 months which align to our pledges:
- We elevated the utmost reward attainable for our Home windows Intercept X product by $20,000 USD; researchers can now earn $80,000 USD for a P1 submission
- We added a brand new reward which pays as much as $50,000 USD for a P1 discovering in Central
- We prolonged our premium bug bounty scope to incorporate financial rewards for legitimate vulnerabilities recognized in Taegis and Redcloak, following Sophos’ acquisition of Secureworks earlier in 2025.
We plan to share insights and classes discovered from the bug bounty program in a follow-up publish later this 12 months.
CVEs
Our 2024 pledge:
We pledge to increase our inside processes to persistently publish exterior CVEs for all recognized inside vulnerabilities of a severity of excessive or important in our merchandise.
How did we do?
Now we have met this pledge by increasing our inside processes to make sure that any vulnerability recognized internally and assessed as excessive or important severity is ready for exterior CVE publication. Though no vulnerabilities have but been recognized which meet this threshold for publication, the up to date processes are totally in place and able to help constant and clear disclosure going ahead.
Transparently publishing CVEs for internally found points helps our prospects higher perceive the safety posture of our merchandise, helps knowledgeable decision-making, and displays our dedication to business greatest practices.
Proof of intrusions
Our 2024 pledge:
We pledge to supply further integration capabilities in Sophos Central to simplify the ingestion of audit logs into third events, with goal implementation previous to July 2025.
How did we do?
Whereas we’ve got made foundational progress towards this aim, we’ve needed to modify the timeline to mirror the numerous organizational adjustments and new product alternatives ensuing from our acquisition of Secureworks earlier in 2025.
We stay totally dedicated to this pledge and can proceed to supply updates as we roll out enhancements.
Having reviewed our progress in opposition to the commitments we made final 12 months, we’re now centered on the street forward. Within the close to future, we’ll share the up to date pledges we’re making for the approaching 12 months— constructing on what we’ve discovered, the place we’ve superior, and the place we nonetheless have work to do. Our mission stays the identical: to constantly strengthen the safety, transparency, and trustworthiness of our merchandise, in alignment with the Safe by Design rules.
