Sophos, the British cybersecurity company based in Oxford, said it had acquired Arco Cyber, a London startup that builds software to show whether an organisation's security controls are actually working. The deal was reported by IT Channel Oxygen on February 10, 2026, and covered by Verdict the following day.
The price was not disclosed. Arco co-founder and chief executive Matt Helling told IT Channel Oxygen that Sophos was putting a lot of money behind the business so it could pursue its original goals.
Arco is joining Sophos as a dedicated team, and its technology is being built into Sophos Central, the company's management platform. Sophos said Arco would underpin CISO Advantage, its new set of services meant to give organisations the judgment of a chief information security officer whether or not they employ one.
What Arco Cyber built
Arco's cloud platform collects and correlates data from the security tools a company already runs. From that data it shows which controls are working, where the gaps are, and which fixes should come first based on business and risk impact, according to Verdict.
Sophos said Arco adds continuous checks on whether controls are effective, maps those controls to risk and compliance frameworks, and produces reports written for executives and boards. Helling had earlier described the product to IT Channel Oxygen as a control tower for CISOs, aimed at chief security officers, IT teams and finance chiefs.
The company sold through partners. Resellers could offer Arco directly or white-label it inside their own consulting services, and Helling said Arco had around seven partners, including Softcat.
“This gives us the clout and the comfort of being under a massive brand like Sophos.”
Why Sophos is buying
Sophos chief executive Joe Levy said the market had no shortage of good security technology, and that what most organisations lacked was a way to govern their tools and know whether their controls were working. CISO Advantage combines agentic AI, Sophos's platforms and human expertise, and is sold through managed service providers and managed security service providers, which can then offer CISO-level leadership as a service.
Phil Harris, a research director at IDC, said in the Sophos announcement that boards, regulators and insurers increasingly wanted evidence that security spending reduces risk.
Helling said most businesses in the UK and elsewhere did not have a CISO at all, and that the partner and MSP channel was the way to reach them. He told IT Channel Oxygen that Levy's plans for the business were closely aligned with what Arco had set out to do.
The founders and a bootstrapped run
Helling and Adam Louca, both former Softcat executives, set up Arco in October 2022 together with Graham Sawell, chief executive of Datamango. The company never raised outside capital. In an earlier interview, Helling told IT Channel Oxygen that he would probably not bootstrap again, and that Arco had lost some deals because its platform was not yet mature enough.
On the sale, he said running a bootstrapped cybersecurity startup was hard, because better-funded rivals could move faster. Arco had seven employees, and Helling said staff had gone without high pay or benefits while building the company.
Sophos first approached Arco the previous summer as a possible strategic partner. The founders had planned on a five-year horizon, and the sale came more than two years earlier than that.
Helling said the team had to decide whether it had done enough of the job and whether Sophos was the right home for the people and the platform. He described the outcome as a fairytale ending for a small company whose team's families had also carried the strain of the early years.
What happens to customers
Helling said existing and new partners would benefit because the product would now develop faster than Arco could have managed alone. Sophos said Arco's technology would help its partners offer continuous assurance, risk mapping and compliance monitoring from within Sophos Central.
Arco straddled two parts of the market, governance, risk and compliance software and continuous controls monitoring, according to IT Channel Oxygen. Sophos did not say when the integrated product would be generally available.
