Sophos Cuts Threat Investigation Time by 96% Using OpenAI

Overview

Sophos, a global cybersecurity firm, has reported a dramatic reduction in threat investigation times after integrating OpenAI Daybreak into its security operations. By combining frontier AI models with its own extensive threat intelligence, the company claims to have cut average response times by 96 percent.

The integration has also enabled Sophos to resolve over half of its Managed Detection and Response (MDR) cases entirely through AI agents. This shift allows human analysts to focus their expertise on complex exceptions rather than routine triage, marking a significant evolution in how large-scale cyber defenses are operated.

The Integration of Frontier AI and Cybersecurity Expertise

Sophos has partnered with OpenAI through the Daybreak program to merge advanced language models with decades of cybersecurity domain knowledge. The initiative is not merely about adding a new tool for analysts but aims to scale Sophos’s existing expertise across its entire customer base.

John Peterson, Sophos Chief Technology Officer, emphasized that while the company possesses vast experience in combating diverse attacks, the scale of the threat landscape requires amplified capabilities. Frontier AI provides the intelligence layer that allows this historical expertise to be applied more broadly and efficiently.

“Sophos brings the domain expertise and the know-how to combat attacks at scale. Programmes like Daybreak, and companies like OpenAI, bring frontier intelligence that allows us to take that domain expertise and scale it to support all of our customers.” — John Peterson, CTO, Sophos

This approach addresses a critical dynamic in modern cybersecurity: while advanced AI models help defenders identify threats faster, those same capabilities are becoming accessible through open-weight models to attackers. This dual-use nature of AI accelerates vulnerability discovery and exploitation, narrowing the window for defenders. Sophos’s strategy focuses on leveraging superior, integrated systems to stay ahead of adversaries who may rely on less sophisticated AI tools.

Inside the Rollout: Sophos Fusion and AI Agents

At the core of this transformation is Sophos Fusion, an AI-native cyber defense system that aggregates sensor data from more than 500 third-party integrations alongside native Sophos products. These sensors generate trillions of events daily, which are distilled into approximately 1,000 to 2,000 investigative cases for the company’s nine security operations centers.

Previously, handling these cases relied heavily on human judgment and manual processes. The average investigation time stood at roughly 38 minutes, a performance metric that already exceeded 96 percent of professional security operations centers. However, the introduction of Daybreak-built agents has fundamentally altered this workflow.

Agents now handle multiple stages of the investigation lifecycle:

Investigation Agents: Gather customer context, detections, indicators of compromise (IoCs), and relevant threat intelligence for each case.
Planning Models: Establish a plan-execute-review loop, creating detailed investigation plans and producing summaries with recommended response actions.
Response Agents: Execute specific parts of the remediation process based on the established plan.

Since implementing these agents, the average response time for cases utilizing AI has dropped to just 89 seconds. Furthermore, approximately 52 percent of MDR cases are now resolved end-to-end by these automated systems within parameters calibrated by Sophos analysts.

Maintaining Human Oversight and Control

Despite the high degree of automation, Sophos maintains that human judgment remains central to its security operations. The company has embedded customer control into its MDR service through three distinct operating modes, ensuring that automation never bypasses critical decision points.

The available modes include:

Notify: Sophos investigates the case and recommends a response, but the customer performs the action.
Collaborate: Sophos and the customer work together before any action is taken.
Authorise: Sophos is permitted to respond directly on the customer’s behalf.

These boundaries apply consistently whether work is performed by a human analyst or an AI agent. Peterson noted that any scenario deemed unsuitable for autonomous handling is immediately escalated for human review. This ensures that potentially destructive actions require appropriate oversight, balancing speed with safety.

The results of this balanced approach have been significant:

Reduced average response time for agent-led cases from approximately 38 minutes to 89 seconds.
Enabled the end-to-end resolution of 52 percent of MDR cases using AI.
Provided customers with a faster and more consistent investigation experience.
Allowed Sophos to scale compute resources rather than relying on proportional growth in scarce cybersecurity talent.
Returned analyst attention to high-value threats, exceptions, and strategic decisions.

Strategic Outlook and Advice for Security Leaders

Looking forward, Sophos plans to expand the capabilities of its AI agents, making response functions more sophisticated and broadening the range of use cases addressed. Peterson views programs like Daybreak as essential for maintaining a competitive edge against an attacker community that is increasingly leveraging AI.

Beyond technological adoption, Peterson advised security leaders to prioritize foundational security practices. He cautioned that while patching is essential, vendors can only address known vulnerabilities. Consequently, a layered security approach is more critical than ever.

This approach should include:

Robust endpoint protection.
Multifactor authentication (MFA).
Network segmentation.
Strong security operations.

Peterson highlighted that vulnerabilities are being discovered and exploited at an alarming rate and scale. Therefore, mastering the fundamentals remains the most effective strategy for organizations seeking to protect their assets in an evolving threat landscape.