iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Sophos announced in February 2026 that it acquired UK-based cybersecurity assurance company Arco Cyber. The planned integration is intended to help managed service providers (MSPs) and managed security service providers (MSSPs) explain whether security controls work, how they map to risk and compliance requirements, and what those results mean to business leaders—not simply report threat alerts.
Sophos says Arco’s technology and expertise will be integrated into Sophos Central under its CISO Advantage strategy. That is a stated direction and phased plan, not evidence that every planned capability is already generally available in every market.
What Sophos acquired
Sophos describes Arco Cyber as a cybersecurity assurance company. In its announcement, Sophos said Arco would add capabilities for continuously validating security controls, mapping controls to risk and compliance frameworks, and producing insights suitable for executives. The company presented the acquisition as a way to strengthen governance around the security tools organizations already operate.
Sophos CEO Joe Levy summarized the gap the deal is meant to address: “What’s missing for most organizations is the ability to govern those tools, understand whether controls are actually working, and make informed decisions about risk.” (Sophos announcement)
CRN reported that financial terms were not disclosed and that about eight Arco employees, including the founders, were joining Sophos. (CRN report)
What Arco is expected to add
| Capability | Practical purpose for an MSP or MSSP | What is established |
|---|---|---|
| Continuous control validation | Check whether configured controls are operating as intended instead of assuming that a deployed product provides protection. | Sophos says this is part of Arco’s contribution; no independent performance results were disclosed. |
| Risk and compliance mapping | Relate technical safeguards to business risks and relevant regulatory or control frameworks. | Sophos says Arco has this capability; the sources do not specify a final framework list. |
| Executive-ready reporting | Turn technical findings into understandable views of risk, investment and control effectiveness. | Planned as part of the CISO Advantage direction; a complete, generally available feature set was not established. |
| Sophos Central integration | Give partners a place to combine operational security information with assurance and governance context. | Sophos announced an integration plan, not a completed worldwide rollout. |
Why the deal is aimed at MSP conversations
MSPs and MSSPs already operate security products for many customers. Sophos’s stated goal is to help those partners move from technology operators to strategic security advisers who can deliver CISO-level leadership as a service.
Rob Harrison, Sophos’s senior vice president of product management, told CRN that customers need to ask: “How do those investments align to your strategy? How do you know you’re actually getting a return on that investment in a transparent, repeatable way? And how do you know the controls are configured properly and actually protecting you?” (CRN interview)
That changes the partner conversation from “How many alerts did we process?” to questions such as:
- Which business risks are the customer’s security investments intended to reduce?
- Are the relevant controls enabled, correctly configured and still functioning?
- What evidence supports a compliance or insurance discussion?
- What should leadership fund, change or accept next?
Sophos has described a vision in which Sophos Central presents a customer’s broader security program, risk profile and investment outcomes, rather than only detections. CRN characterized that as a vision for the platform, not as a description of an already delivered feature. (CRN report)
How CISO Advantage fits
Sophos frames CISO Advantage as a combination of AI-assisted systems, an integrated platform and human expertise delivered through MSPs and MSSPs. The objective, according to Sophos, is to make CISO-level guidance available to organizations with or without a dedicated security leader. Arco’s assurance capabilities are intended to supply the evidence and governance layer for that service, alongside advisory work and managed detection and response.
Harrison called the acquisition “a really strong statement” about moving “from just tools and alerts to helping customers truly understand risk, measure ROI and run security as a disciplined business program.” That is Sophos’s strategic ambition; the supplied sources do not report independent measurements of return on investment, incident reduction or compliance improvement.
Rollout, regions and availability
CRN reported a planned phased rollout beginning in the UK, where Arco had its deepest regulatory-framework coverage. The reported plan then called for expansion to North America and Europe within one quarter, select MSP early-access programs, and a global rollout within 12 months. (CRN report)
Best Value
Those milestones describe a reported plan, not a current availability guarantee. The published material does not establish final general availability, regional eligibility, purchase price, final deal terms or which Sophos Central subscriptions will include the capabilities. Partners should confirm scope, access and commercial terms with Sophos before promising a customer a feature or launch date.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What an MSP should evaluate before adopting the approach
The acquisition announcement explains the intended direction, but it does not provide comparative testing. An MSP assessing Sophos’s evolving offering should request evidence in six areas:
- Validation method: What does “continuous” checking measure, how often does it run, and how are false positives or stale evidence handled?
- Framework coverage: Which regulatory and control frameworks are supported in the customer’s jurisdiction, and how are mappings maintained when requirements change?
- Integration: Which Sophos and third-party tools contribute data, and what happens when a customer has a mixed security stack?
- Executive reporting: Can reports connect a control failure to business impact, owner, remediation cost and residual risk without requiring an analyst to rewrite them?
- Human oversight: Which recommendations are automated, and where do an adviser, vCISO or incident specialist review the result?
- Multi-customer operations: Can a partner apply policies, evidence collection and reporting across many tenants while preserving customer-specific context and access controls?
Ask how outcomes will be measured after deployment. The available announcements do not supply independent benchmarks, adoption figures or proof that the integration has improved security or compliance results.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the Spektrum partnership relates—and does not relate
Sophos separately announced a partnership with Spektrum Labs connecting Sophos MDR with continuous cyber-resilience validation and evidence for insurance underwriting. Sophos said that offering was initially available to select customers and partners, with broader availability expected in mid-2026. (Sophos and Spektrum announcement)
That program is adjacent context, not part of the Arco acquisition. Eligibility, geography and current availability should be verified separately.
Quick Recap
What is known—and what is not
- Known: Sophos announced the acquisition of Arco Cyber and an intended Sophos Central integration focused on assurance, governance, risk and compliance.
- Known: MSPs and MSSPs are central to Sophos’s plan to deliver CISO-level guidance as a service.
- Not established: The disclosed purchase price, final deal terms, worldwide general availability, measured customer outcomes and independent comparisons with other risk platforms.
- Use with care: Sophos’s release repeats an estimate of 359 million organizations worldwide and fewer than 32,000 with a CISO, citing Cybersecurity Ventures’ 2023 CISO report. Treat those as Sophos-reproduced estimates rather than independently verified results.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
