Cybersecurity firm Sophos has acquired UK-based Arco Cyber in a move aimed at expanding AI-powered governance and risk oversight services to organisations lacking dedicated security leadership.
The acquisition is designed to strengthen Sophos’ strategy of delivering what it calls “CISO-level” capabilities through its global network of managed service providers (MSPs) and managed security service providers (MSSPs).
The approach combines agentic AI systems with human oversight to provide real-time insight into the effectiveness of security controls and risk management.
Arco Cyber specialises in cybersecurity assurance, helping organisations validate whether their security controls are working, align them with risk and compliance frameworks, and present executive-level reporting to support decision-making.
“There is no shortage of exemplary security technology in the market,” said Joe Levy, CEO of Sophos.
Joe added, “What’s missing for most organisations is the ability to govern those tools, understand whether controls are actually working, and make informed decisions about risk. Arco has built a platform and a team that offers clarity, accountability, and proof. That work directly supports our strategy, and it gives customers a stronger foundation for simplifying compliance and managing cyber risk with confidence.”
The deal comes amid a global shortfall in cybersecurity leadership. Sophos cited industry estimates showing there are about 359 million organisations worldwide but fewer than 32,000 Chief Information Security Officers (CISOs).
Phil Harris, Research Director, Governance, Risk and Compliance Solutions at IDC, said, “Boards, regulators, and insurers want clear evidence that security investments are reducing risk and strengthening governance.
“Platforms that integrate detection and response with assurance, advisory, and risk-based measurement are better aligned with how organisations actually operate. The Sophos and Arco Cyber combination represents a new category of platform-led cybersecurity that connects operations, assurance, and risk-based outcomes.”
Arco Cyber’s team and technology will be integrated into Sophos Central, the company’s cybersecurity platform, as part of efforts to provide structured governance and risk oversight to organisations with and without dedicated CISOs.
