The industry turned XDR and SIEM into categories. Sophos turned them into outcomes.

Sophos Next-Gen SIEM, now generally available as part of Sophos Fusion, brings security operations and compliance together through shared context.

For years, the cybersecurity industry has blurred the lines between XDR and SIEM. As capabilities converged, organizations were left trying to connect separate security operations and compliance solutions, often moving the same data between different tools, workflows, and teams.

Security teams have been asked to do more than ever: detect and investigate threats faster, automate response actions, and retain growing volumes of data. This is in addition to reconstructing activity across different systems, manually correlating events, and bridging gaps between operational and compliance requirements. 

Pricing tied directly to data ingestion created another challenge. As data volumes grew, organizations were forced to choose between greater visibility, retention, and cost, even when historical context could prove critical during an investigation, audit, or incident review. 

At Sophos, we think the conversation has focused on the wrong thing.

The question is not whether an organization needs XDR or SIEM. The question is whether security operations and compliance should require separate solutions, separate workflows, and separate data foundations in the first place.

We don’t think so. The work is different. The data does not have to be.

Designed around outcomes, built on shared context

When Sophos acquired Secureworks in 2025, we brought together two of the most influential lineages in cybersecurity. This gave us an opportunity to rethink how security operations and compliance should work together.  

Rather than forcing organizations to treat XDR and SIEM as separate data foundations, Sophos Fusion brings them together through shared context while keeping security outcomes at the center.