Secure by Design in practice: a year of progress on Sophos Firewall

In response to the FortiBleed credential dump and related brute-force/stuffing activity against edge devices, Sophos details its firewall hardening and detections (v22 architectural changes, Sophos Linux Sensor, traceable telemetry, hotfix visibility, scheduled updates), fixes to MFA onboarding to mitigate trust-on-first-use enrollment, and investments in telemetry and fleet forensics to enable rapid characterization of future campaigns. The company reports no evidence of exploitation of Sophos devices in this campaign, describes an internal AI-enabled vulnerability-hunting platform, maps progress to NCSC forensic guidance, and commits to delivering remote forensic capture and expanded attack-facing telemetry.