Sophos Cuts Threat Investigation Time by 96% With OpenAI Daybreak

Sophos says OpenAI Daybreak helped reduce its average threat investigation and response time by 96%, from about 38 minutes to 89 seconds. The cybersecurity provider now reports that artificial intelligence resolves 52% of its managed detection and response cases from beginning to end.

Those results mark a more consequential step than adding an AI assistant to an analyst console. Sophos has assigned AI agents operational responsibility for over half its case volume, within boundaries its security specialists continually adjust.

That distinction puts the company on the opposite side of a familiar security operations model. Instead of asking analysts to supervise every routine investigation, Sophos lets agents handle bounded cases while people concentrate on uncertain or consequential decisions. The critical question is whether that division can preserve accountability as automation expands.

OpenAI Daybreak Moves From Assistance to Case Resolution

The central change is not faster summarization. Sophos is allowing agents to complete defined investigations and responses without requiring human intervention in every case.

According to the OpenAI case study, Sophos previously needed about 38 minutes to investigate and respond to an average case. Cases processed by its new agents now reach an average response time of about 89 seconds.

That decline represents a reduction of roughly 96%. Sophos also says the agents resolve 52% of its managed detection and response, or MDR, cases from beginning to end.

MDR is a service in which an external security team continuously monitors customer environments and responds to detected threats. It gives organizations access to security operations without requiring them to build a complete internal security operations center.

The reported improvement applies to cases handled by the agents. It should not be interpreted as proof that every investigation across Sophos now closes in 89 seconds.

That scope matters because security cases vary widely. A familiar malicious file can support a tightly defined response, while suspicious identity activity can require business context that telemetry cannot provide.

Sophos says its Fusion system gathers signals from its products and more than 500 third-party integrations. Those sources cover environments that can include endpoints, networks, cloud services, email systems, firewalls, and identity platforms.

The combined sensors generate trillions of events each day, according to OpenAI. Sophos filters and correlates that activity into approximately 1,000 to 2,000 cases for nine security operations centers to investigate.

An investigation agent collects the relevant customer context, detections, indicators of compromise, and threat intelligence. A planning model then creates an investigation plan, executes its steps, reviews the results, and prepares recommended actions.

Other agents can perform parts of the response when the customer’s authorization and Sophos’s operating boundaries permit it. That workflow turns the model into an orchestrator, not merely a conversational interface.

The result also builds on an earlier automation effort. In May 2026, Sophos reported agentic SOC results covering a year of production use.

That announcement also cited an 89-second automated response time and a 52% end-to-end closure rate. OpenAI’s October case study therefore provides more detail about Daybreak’s role, rather than introducing those measurements for the first time.

This history makes the evidence more substantial than a laboratory demonstration. However, both published accounts remain company-reported measurements, not an independent comparison using a common industry benchmark.

Why an 89-Second Response Changes the MDR Contest

Sophos is pressuring managed security providers to compete on completed outcomes, rather than the number of alerts their AI can summarize.

Security operations teams already use automation to suppress noise, correlate alerts, and prioritize suspicious activity. The harder step is letting software decide that the evidence supports a response and then execute it.

Sophos says its MDR operation protects more than 40,000 customers. Its broader product portfolio serves more than 625,000 organizations, giving the company a large pool of security signals and operational experience.

At that scale, even a small amount of manual work per case becomes expensive. Case volume can also grow faster than an organization can recruit and train experienced analysts.

The Daybreak deployment changes the scaling equation. Sophos can increase model inference and automation capacity without hiring one analyst for every corresponding increase in routine investigations.

That does not mean analysts disappear from the operating model. It means their work shifts away from collecting routine context and toward novel attacks, ambiguous evidence, customer communication, threat hunting, and governance.

The distinction is important for buyers. A tool that produces an incident summary can save minutes, but it still places the decision and execution burden on a human queue.

An agent that gathers evidence, tests a hypothesis, reaches a bounded verdict, and performs an approved action changes the queue itself. Routine cases no longer need to wait for an analyst to touch every step.

Sophos had already built a substantial filtering pipeline before Daybreak. An earlier description of its MDR event flow explained how telemetry is cleaned, enriched, correlated, prioritized, and escalated.

That pipeline processed about 31 billion events and 358 million detections on a typical day at the time of publication. It reduced that activity to 367 investigations, 47 escalations, and one active threat.

Those earlier figures describe a different reporting period and should not be combined directly with the newer daily estimates. They still illustrate why filtering is central to managed security operations.

The agents are entering after several layers have already narrowed the data. They are not reasoning independently across every raw event generated by every customer.

This architecture gives Sophos a defensible advantage over companies applying general-purpose models directly to unstructured alerts. The agents receive curated cases, threat intelligence, response playbooks, and customer context.

Competitors are pursuing similar territory. Microsoft Security Copilot agents can assist with incident triage, threat intelligence, investigations, and remediation guidance across Microsoft’s security products.

Microsoft’s documentation describes agents that analyze incidents, extract entities, correlate signals, and determine whether activity is malicious. This confirms that agent-led security operations are becoming an industry contest, not a one-company experiment.

Sophos’s differentiator is its claim of production-scale end-to-end resolution across a managed service. Competitors will face pressure to disclose comparable completion rates, response times, escalation rates, and authorization models.

How Sophos AI Security Agents Divide the Work

The mechanism works because Sophos limits the agents’ authority by case type, customer preference, and potential impact.

OpenAI describes Daybreak as a governed cybersecurity stack combining specialized models, an execution harness, security tools, trusted workflows, and industry partners. Its stated goal is to support defensive work while retaining human control over access and action.

Sophos supplies the operating environment around those models. That environment includes threat intelligence, investigation procedures, customer telemetry, detection logic, and response playbooks developed through years of security operations.

This combination matters because a language model alone does not know whether an unfamiliar process is normal for a particular organization. It needs current asset details, identity information, historical activity, and verified security evidence.

For each case, the investigation agent assembles that context. The planning system then follows a plan, execute, and review loop instead of generating one answer from one prompt.

Breaking the work into stages allows the system to reassess its evidence. It also produces a structured record that analysts can review when a case needs escalation.

Sophos divides customer response authority into three operating modes. Under Notify, Sophos investigates and recommends an action, but the customer performs it.

Under Collaborate, Sophos and the customer work together before taking action. Under Authorise, Sophos can respond directly for the customer within agreed boundaries.

Those rules apply regardless of whether a person or an agent performs the work. An agent does not automatically receive broader authority simply because it can reach a verdict quickly.

Potentially destructive actions remain subject to the appropriate oversight. John Peterson, Sophos’s chief technology officer, told OpenAI that cases outside the company’s comfort level pass to human judgment.

That creates two related operating patterns. Human-on-the-loop automation allows specialists to supervise well-bounded work without approving every action individually.

Human-in-the-loop operation requires a person to intervene before a sensitive decision or response proceeds. Sophos says it uses that stricter model for novel patterns, high-stakes decisions, and cases requiring business context.

This division helps explain how 52% automation can coexist with human accountability. The automated share represents cases that Sophos believes fit established boundaries, not permission for unrestricted autonomous response.

It also explains why the remaining 48% is significant. Cases that resist automation are likely to contain the unusual behavior, incomplete evidence, or business consequences that demand deeper expertise.

A simple productivity reading misses this redistribution. The system’s value depends on whether it moves analysts toward more consequential work without allowing their routine investigative skills to erode.

Organizations adopting similar systems will need durable documentation for response playbooks, past incidents, and operating exceptions. A searchable engineering knowledge base can help teams preserve that context, although it cannot replace validated security controls.

The mechanism therefore has two essential components. Models supply speed and reasoning capacity, while governance decides which conclusions can trigger action.

Human Oversight Is a Control System, Not a Slogan

The unresolved issue is whether Sophos can measure agent errors as rigorously as it measures agent speed.

The 96% reduction and 52% closure rate describe throughput. They do not disclose false-positive rates, false-negative rates, reopened cases, customer reversals, or the frequency of analyst corrections.

Those omissions do not invalidate the results. They limit what outside observers can conclude about reliability.

A fast response is valuable when an agent correctly isolates a compromised device. The same speed becomes dangerous if it disables a critical system after misreading legitimate administrative activity.

Cybersecurity agents also operate in an adversarial environment. Attackers can deliberately craft files, messages, commands, and web content intended to confuse automated analysis.

Models can generate plausible but incorrect interpretations when evidence is incomplete. They can also place excessive confidence in weak indicators or miss context that an experienced analyst recognizes.

This is not a theoretical limitation unique to Sophos. Anthropic reported that an AI system involved in an orchestrated cyber espionage campaign sometimes overstated findings and fabricated data during autonomous work.

In its campaign analysis, the model reportedly claimed to obtain credentials that failed and mislabeled public information as important discoveries.

That case concerned offensive misuse, not Sophos’s defensive system. It still demonstrates why model-generated evidence and conclusions require validation before consequential actions.

Microsoft gives similar warnings for its own security agents. Its responsible AI guidance says generated responses can be inaccurate, incomplete, or outdated.

Microsoft advises customers to use appropriate human oversight, validate critical outputs, apply least-privilege permissions, and avoid overreliance. Those principles apply equally to any agent that can investigate or respond.

Sophos’s three authorization modes provide a credible control framework. Yet the strength of that framework depends on how boundaries are defined, tested, monitored, and revised.

The company says analysts continually calibrate the limits. More disclosure would help customers understand what that process means in practice.

Useful measures would include the percentage of automated cases later reopened, the rate of customer overrides, and the number of actions blocked by safety policies. Sophos could also report performance by case category.

Aggregated results can conceal important variation. Malware containment, phishing analysis, identity compromise, cloud misconfiguration, and insider activity present different evidence and different consequences.

Customers also need clarity about data handling. An investigation can involve device details, user identities, email metadata, threat intelligence, and information drawn from third-party security products.

The relevant questions include where data is processed, how long it is retained, which model components can access it, and how actions are logged. Contractual controls matter alongside model performance.

Human oversight has its own failure modes. Analysts can become less attentive when automation is usually correct, a pattern often described as automation bias.

Reviewers also need enough visibility into the agent’s evidence and reasoning process to challenge its conclusion. A recommendation without traceable support encourages approval by habit.

The test is therefore not whether a human remains somewhere in the workflow. The test is whether that person has authority, time, context, and usable evidence to stop a bad action.

The Real Contest Is Bounded Autonomy Versus Copilot Assistance

Sophos is betting that governed autonomy delivers more operational value than an AI assistant waiting for an analyst’s next prompt.

The early generation of security copilots focused on conversational access. Analysts could request incident summaries, produce queries, explain suspicious scripts, and draft remediation instructions.

Those functions reduce cognitive and administrative work. They do not necessarily remove cases from the investigation queue.

Sophos’s approach targets the entire lifecycle of selected cases. The agent collects context, plans an investigation, performs steps, reviews results, recommends a response, and sometimes executes it.

That difference creates the article’s primary tension. Copilot assistance keeps a person in each operational loop, while bounded autonomy removes that requirement for repeatable cases.

Neither route is universally superior. Copilot assistance is easier to introduce where data quality varies, processes remain informal, or the consequences of a mistake are severe.

Bounded autonomy becomes more attractive when an organization has reliable telemetry, mature playbooks, clear permissions, and enough case volume to justify extensive validation.

Sophos possesses several of those conditions. Its managed service centralizes procedures across thousands of customers and repeatedly encounters recognizable attack patterns.

A typical enterprise security team may not have the same advantage. Its logs can be incomplete, its response processes may differ between business units, and ownership can be unclear.

That difference limits direct comparisons between Sophos and internal security operations centers. A managed provider can standardize infrastructure and policy more aggressively than many individual customers.

It also means the Daybreak result is partly an operations story. The model sits inside a system that already filters events, enriches detections, organizes cases, and defines response authority.

OpenAI’s broader Daybreak program frames cybersecurity as a continuous loop covering inventory, discovery, validation, assignment, remediation, and proof. That ambition extends well beyond chat-based assistance.

If that model spreads, buyers will need a better vocabulary for evaluating automation. The label “AI-powered” says almost nothing about what a product actually does.

A useful evaluation should ask what initiates the agent, which evidence it can retrieve, which tools it can operate, and which actions it can take. Buyers should also ask when escalation becomes mandatory.

Completion rate is another important measure. An agent that autonomously closes a well-defined case produces a different outcome from one that saves an analyst several minutes.

However, vendors should not compete by maximizing autonomous closure at any cost. A lower closure rate can reflect stricter safety thresholds or a more complex customer base.

The meaningful goal is an appropriate automation rate for a defined risk level. That requires paired reporting on speed, accuracy, escalation quality, and operational impact.

Sophos has moved the discussion closer to that standard by publishing a response time and end-to-end closure rate. The next step is pairing those figures with transparent reliability measures.

What to Watch After the OpenAI Daybreak Rollout

The next phase will determine whether Sophos has established a durable security operating model or published an impressive snapshot from favorable workloads.

The first signal is the quality of the automated cases over time. Customers should watch for disclosures about reopened investigations, incorrect responses, missed threats, and analyst overrides.

Stable performance would strengthen Sophos’s argument that the 52% closure rate reflects dependable automation. Rising correction rates would suggest that greater autonomy is shifting work rather than eliminating it.

The second signal is expansion into more difficult response actions. Sophos says it plans to broaden the agents’ use cases and make their response capabilities more sophisticated.

That expansion will test the governance framework. Collecting evidence and containing a known malicious endpoint present different risks from changing identity permissions or disrupting production infrastructure.

Success should therefore be measured by controlled scope, not simply by a higher automation percentage. The company must show that additional authority arrives with appropriate evaluation and rollback mechanisms.

The third signal is competitor reporting. Microsoft and other security vendors already offer agents for triage, investigation, threat intelligence, and remediation workflows.

If competitors begin publishing end-to-end resolution rates and comparable timing data, buyers will gain a clearer market benchmark. If they avoid those measures, Sophos’s production disclosure will remain a notable differentiator.

Customers should still examine whether comparisons use the same starting point. “Response time” can begin at alert generation, case creation, model activation, or analyst validation.

They should also separate automated containment from complete remediation. Isolating a device may stop immediate activity, but restoring systems and closing the attacker’s access path can require additional work.

For security leaders, the practical response is not to demand unrestricted autonomy. It is to identify high-volume cases with reliable evidence, reversible actions, and mature escalation rules.

They can then evaluate whether agents reduce total analyst work without weakening detection quality or accountability. That assessment should include adversarial testing and routine sampling of automatically closed cases.

Sophos’s reported results make that evaluation harder to postpone. A reduction from 38 minutes to 89 seconds changes expectations for routine managed investigations, even with the current verification limits.

OpenAI Daybreak also shows where enterprise agents are becoming most consequential. Their value lies less in producing fluent explanations and more in completing governed workflows connected to real tools.

The final question for buyers is concrete: can a provider show which cases its agents close, how often those decisions are corrected, and who remains accountable when automation fails?

Those answers will matter more than the largest headline percentage. Security teams should request them before granting any agent broader authority, then keep measuring them after deployment.