Sophos cuts average threat response time from 38 minutes to 89 seconds with OpenAI Daybreak

Combining frontier models with decades of security expertise

Sophos protects more than 625,000 organisations across sectors and regions. Through OpenAI Daybreak, it is combining OpenAI models with its own threat intelligence, response playbooks and security expertise. OpenAI frames the aim as extending the impact of Sophos's expertise across every customer, rather than simply giving analysts another tool.

The context is a changing threat picture. OpenAI notes that frontier AI helps defenders find and investigate threats faster, but that similar capabilities are also spreading to open-weight models, giving attackers new ways to discover vulnerabilities and accelerate exploitation.

John Peterson, Sophos's Chief Technology Officer, said the company brings "the domain expertise and the know-how to combat attacks at scale", while programmes like Daybreak bring frontier intelligence that lets Sophos scale that expertise to all of its customers.

How the agents work inside Sophos Fusion

The work centres on Sophos Fusion, the company's AI-native cyber defense system, which includes Sophos Managed Detection and Response. Fusion draws on sensor data from more than 500 third-party integrations as well as Sophos's own products. Those sensors generate trillions of events every day, which Sophos distills into roughly 1,000 to 2,000 cases for its nine security operations centres to investigate.

Agents built through Daybreak now handle part of that workload:

• An investigation agent gathers the customer context, detections, indicators of compromise and relevant threat intelligence for each case.
• A planning model creates a plan-execute-review loop: it builds an investigation plan, completes the steps and produces a summary with recommended response actions for analysts to review.
• Other agents can carry out parts of the response.

Before Daybreak, handling a case depended primarily on human expertise. Sophos's earlier process averaged around 38 minutes, which Peterson says was better than 96% of professional security operations centres. He says the average for cases using the new agents has fallen to about 89 seconds, and that about half of the cases Sophos handles are now automated by agents developed with the Daybreak models.

Human oversight stays in place

Sophos's MDR service gives customers control through three operating modes. In Notify, Sophos investigates and recommends a response, but the customer acts. In Collaborate, Sophos and the customer work together before action is taken. In Authorise, Sophos can respond directly on the customer's behalf.

According to the company, the same boundaries apply whether a person or an agent does the work. Potentially destructive actions still require the right level of human oversight. Peterson said: "Anything we don't feel comfortable with an agent handling gets passed off for human judgement."

What it means for customers and security teams

OpenAI lists several results from the rollout: faster and more consistent investigations for customers, 52% of MDR cases resolved end-to-end with AI within boundaries calibrated by Sophos analysts, and a way to scale compute rather than depend on equivalent growth in scarce cybersecurity headcount. Analysts, in turn, can focus on the threats, exceptions and decisions where their expertise matters most.

Peterson said Sophos will keep expanding the agents, with response capabilities becoming more sophisticated and a broader range of use cases. For other security leaders, his advice is to return to fundamentals. Patches only cover vulnerabilities known to the vendor, he said, so organisations should maintain "a layered security approach" that includes endpoint protection, multifactor authentication, network segmentation and strong security operations.