Partner content: The Evolution of the Network Firewall: From Perimeter Protection to Active Defence

Once the foundation of network security, the traditional firewall is no longer sufficient to protect against today’s evolving threats.

In an age of advanced persistent threats, encrypted command-and-control traffic, and increasingly aggressive ransomware, IT teams need more than just prevention. They need visibility, intelligence, and automated response capabilities – all without compromising performance or increasing management overhead.

As recent breaches have shown, even a single exposed service or overlooked flaw can serve as the entry point for a sophisticated, multi-stage attack1. And at the same time, firewalls have become more complex to manage, especially as security operations are stretched thin and many IT environments operate with a mix of legacy systems and modern workloads across hybrid networks.

These challenges – exploited flaws and operational complexity – highlight a growing need for a more intelligent, integrated approach to network security.

Detection and Response: The Missing Layer in Most Firewalls

Historically, firewalls have focused on prevention: blocking known threats, applying signature-based detection, and enforcing traffic rules. While these features remain essential, they are no longer enough. Modern threats are designed to bypass defences, move laterally across the network, and blend into normal traffic patterns. Without the ability to detect suspicious behaviour and act on it quickly, organisations risk missing critical early warning signs.

This is where Network Detection and Response (NDR) comes into play. NDR solutions are designed to identify abnormal traffic behaviour that may indicate an active adversary inside the network. They analyse both north-south and east-west traffic to uncover stealthy threats, including those leveraging encrypted channels or domain generation algorithms.

Traditionally, NDR solutions have been complex, resource-intensive deployments reserved for large enterprises. But as demand grows – with Gartner forecasting the NDR market to nearly double from 2022 to 20272 – there’s a clear need for a more accessible approach that suits mid-market and distributed IT environments.

Sophos has stepped into this space with a unique, industry-first integration: Sophos Firewall v21.5 now includes a cloud-delivered version of NDR, called NDR Essentials, at no extra cost to customers with the Xstream Protection licence bundle. This new capability sends network traffic data from the firewall to the Sophos Cloud, where it is analysed by AI-powered engines to detect signs of encrypted threat communication and active adversary behaviour.

The key advantage is that all of this analysis happens in the cloud, ensuring that performance on the firewall itself remains unaffected. This approach eliminates the typical trade-off between depth of inspection and system performance.

More than just adding NDR, Sophos Firewall continues to evolve as a detection and response-centric platform. Features like Active Threat Response and integration with the broader Sophos ecosystem mean that insights gathered from network traffic can trigger automated responses across endpoints, email, and other layers of defence. It is not just about seeing more, but about doing more with what is seen.

Simplifying Security Through Integrated Platforms

Another major challenge for IT teams today is managing security across disparate tools. With so many point solutions – each with its own interface, alerting system, and policy engine – teams often struggle to maintain consistent protection or quickly investigate threats3. This fragmented approach increases complexity, delays response times, and can lead to blind spots.

Sophos addresses this challenge through its security-first platform approach, which unifies firewall, endpoint, XDR, and other defences under a single architecture. At the heart of this integration is Sophos’ Synchronized Security, a technology that allows products to share threat intelligence and automate responses in real time.

For example, if NDR Essentials detects suspicious activity on the network, that information can be immediately shared with Sophos Intercept X, which can isolate a compromised endpoint. Similarly, threats discovered on an endpoint can trigger dynamic firewall rules that block traffic to and from the affected device.

This level of cross-product coordination dramatically reduces the time between detection and response, while also simplifying management. IT teams gain visibility across their entire estate through a single dashboard in Sophos Central, making it easier to track threats, configure policies, and demonstrate compliance.

Crucially, these capabilities are delivered without the need for revenue-based licensing barriers or expensive add-ons. Sophos Firewall with Xstream Protection and NDR Essentials ensures that even mid-sized organisations can benefit from enterprise-grade detection and response without the associated complexity or cost.

Sophos Firewall v21.5, with built-in NDR Essentials and Synchronized Security integration, represents a significant evolution and the future of the network firewall.

1: MITRE ATT&CK – Initial Access tactics

2: Gartner - Competitive Landscape: Network Detection and Response

3: CRN Research, May 2025