Sophos has acquired U.K.-based Arco Cyber to expand beyond traditional threat detection and response and into cybersecurity governance, risk and compliance.