Sophos and Rubrik have launched a Microsoft 365 backup and recovery service for Sophos customers worldwide. The product is available through Sophos Central.
Called Sophos Backup and Recovery Powered by Rubrik Cyber Resilience, the service is designed to help organisations restore Microsoft 365 data after ransomware attacks, compromised accounts, insider incidents or accidental deletion.
It expands a partnership the two cybersecurity groups announced last year, bringing Rubrik's software-as-a-service protection for Microsoft 365 into Sophos's main management platform. The product is now in production for thousands of organisations.
Microsoft 365 has become a major target for attackers because it sits at the centre of corporate email, identity and collaboration systems. That has made recovery tools for Exchange Online, OneDrive, SharePoint and Teams increasingly important for companies trying to limit operational disruption after a breach.
Under the new arrangement, security teams can manage backup and recovery alongside threat detection and response from the same console. This should reduce the need to switch between separate tools during an incident.
The service includes immutable backups, support for granular and larger-scale recovery, and automated protection for new users, sites and workloads. It also allows restorations to original or alternative users, including inactive accounts.
Rubrik's technology isolates Microsoft 365 backups with air-gapped architecture and write-once-read-many controls. Customer-controlled encryption is also included, aimed at preventing attackers from altering protected data even when credentials have been compromised.
Single console
The launch reflects a broader shift in the cybersecurity market towards linking detection, response and recovery in one workflow. Companies have typically managed backup and security through separate systems, which can slow incident handling when staff are trying to identify affected data and restore operations.
Sophos Central integrates more than 350 telemetry sources across endpoint, cloud, network, identity, email and business applications. That security context is intended to help teams assess what was affected and decide what data to restore.
Sophos serves more than 600,000 customers worldwide, giving the rollout a large potential installed base. The new service is being sold as an add-on for existing customers.
Tom Foucha, vice president of product management at Sophos, described the offering as a way to tie recovery more closely to frontline security operations. "Staying operational in a world of constant digital disruption requires confidence in your ability to quickly recover," Foucha said. "By bringing recovery directly into the same platform where security teams detect and respond to threats, we're making cyber resilience practical. This gives organisations a faster, more direct way to withstand attacks and keep their business running."
Recovery focus
The announcement also underlines how vendors are trying to address the aftermath of attacks, not just prevention. As identity-based attacks and cloud service compromises become more common, restoring trusted data has become a core part of cyber response planning.
For Microsoft 365 users, that means protecting a broad mix of communications and files stored across multiple services. A compromised account can affect email, documents, team collaboration spaces and shared sites at the same time, increasing the need for coordinated recovery tools.
Mallika Swaminathan, product management lead at Rubrik, said the product is aimed at simplifying those tasks for joint customers. "For organisations, where Microsoft 365 anchors everything from email to collaboration to critical file storage, its resilience isn't optional," Swaminathan said. "Effective cyber resilience means ensuring recovery is reliable and rapid when organisations need it most. By embedding recovery into Sophos Central, we're simplifying how organisations protect and restore their Microsoft 365 data in critical moments."