OpenAI and Sophos cut cyber threat investigation time by 96% with Daybreak-powered AI agents
Sophos has reduced the average investigation and response time for security cases handled by its AI agents from approximately 38 minutes to 89 seconds, using advanced models made available through OpenAI's Daybreak cybersecurity program. The results, announced on October 9, 2026, also show that 52% of Sophos Managed Detection and Response (MDR) cases are now resolved end-to-end by AI, within operational boundaries established by the company's security specialists.
The deployment is part of Sophos Fusion, the company's AI-native cybersecurity platform, which combines information from Sophos products and more than 500 third-party integrations. Across nine security operations centers, Sophos processes telemetry generating trillions of events daily and consolidates that information into approximately 1,000–2,000 cases requiring investigation. Its agents use customer-specific context, threat intelligence, detection records, and established response procedures to investigate suspicious activity, determine appropriate next steps, and assist with remediation.
OpenAI's Daybreak program provides access to advanced cybersecurity models through trusted partners, allowing organizations such as Sophos to incorporate frontier AI capabilities into existing security operations. Rather than replacing the company's threat-detection infrastructure, the models operate within an established system of sensors, investigation procedures, customer permissions, and human oversight.
The reported improvement is substantial, but its scope requires careful interpretation. The 96% reduction applies to the average handling time reported for cases using the agents, not necessarily to every security event or customer incident, while the 52% automation figure does not imply that autonomous systems can independently perform every type of remediation. Both metrics originate from the companies' operational reporting, without a published independent audit or complete description of the evaluation population.
The case provides a concrete example of how AI agents can change the economics of managed cybersecurity services, particularly where analysts must investigate large numbers of alerts under strict time constraints. The longer-term question is whether faster investigations can be maintained alongside reliable threat classification, defensible decisions, and appropriate limits on automated actions.
··········
SOPHOS REPORTS A 96% REDUCTION IN INVESTIGATION TIME AND 52% END-TO-END AI RESOLUTION.
The reported results measure operational performance within Sophos's managed security service, rather than the theoretical capabilities of an isolated AI model.
Before introducing agents developed through Daybreak, Sophos's investigation and response process took approximately 38 minutes per case on average. The company's CTO, John Peterson, reports that cases using the new agents are now handled in approximately 89 seconds, reducing the average elapsed time by around 36 minutes and 31 seconds.
Expressed mathematically, the reduction from 2,280 seconds to 89 seconds corresponds to approximately 96.1%, consistent with the rounded 96% figure reported by OpenAI and Sophos. The resulting ratio is about 25.6 to one, meaning that the previous average duration was approximately 25.6 times the newly reported duration.
This is an elapsed-time comparison, however, and should not be interpreted as an equivalent multiplication of analyst productivity or an identical reduction in cybersecurity operating expenditure. Automated investigations consume computing resources, may run concurrently, and can still require human supervision or subsequent action.
The second principal result concerns the share of cases that AI can handle without requiring a human analyst to perform the complete investigation. Sophos reports that its agents now resolve 52% of MDR cases end-to-end, operating within boundaries determined by its analysts and customer authorization arrangements.
........
Operational indicator | Reported result |
Previous average handling time | Approximately 38 minutes |
Average time for agent-handled cases | 89 seconds |
Reported reduction in handling time | 96% |
Calculated reduction using rounded figures | Approximately 96.1% |
Previous-to-current duration ratio | Approximately 25.6× |
MDR cases resolved end-to-end by AI | 52% |
Daily cases requiring investigation | Approximately 1,000–2,000 |
Sophos security operations centers | 9 |
Third-party integrations | More than 500 |
Organizations protected by Sophos | More than 625,000 |
........
The operational scale is relevant because Sophos does not investigate every raw telemetry event as an independent incident. Endpoint, network, cloud, identity, and other security systems produce enormous quantities of signals, many of which are correlated, filtered, or consolidated before becoming cases requiring detailed assessment.
Consequently, the reported 52% automation rate applies to MDR cases, not to 52% of trillions of telemetry events, 52% of all cyberattacks, or 52% of every security activity performed by Sophos.
A further limitation concerns the comparability of the timing measurements. The published case study provides the previous and current averages but does not disclose detailed sample sizes, observation periods, case-severity distributions, or whether the same types of investigations were represented equally before and after deployment.
Without those details, it is not possible to determine how much of the improvement comes from faster execution of equivalent tasks, changes in case selection, or differences in the composition of the workload. The results nevertheless demonstrate that Sophos has incorporated AI-based automation into a significant portion of its operational investigation process.
··········
OPENAI DAYBREAK AGENTS OPERATE INSIDE SOPHOS FUSION THROUGH A PLAN–EXECUTE–REVIEW WORKFLOW.
The system combines established security telemetry and threat intelligence with specialized agents that collect evidence, organize investigations, and recommend or execute permitted response actions.
Sophos Fusion provides the operational foundation for the deployment. The platform integrates information collected through Sophos security products and external sources, supporting the company's MDR service across customer environments that may include endpoints, corporate networks, cloud infrastructure, email systems, and identity providers.
The first stage begins with an investigation agent that assembles information relevant to a particular security case. This can include the circumstances surrounding a detection, the customer's environment, indicators of compromise (IoCs), and threat intelligence that may help establish whether suspicious activity is associated with a genuine attack.
An indicator of compromise is an observable artifact potentially associated with malicious activity, such as a suspicious IP address, a file hash, or unusual communication behavior. Its presence does not automatically prove compromise: analysts must assess whether the indicator is reliable, current, and relevant to the affected environment.
Once the evidence has been assembled, a planning model creates an investigation strategy using a plan–execute–review loop. The system determines which checks should be conducted, carries out available steps through the surrounding security infrastructure, evaluates the results, and produces a structured summary with recommended actions.
Other agents can perform parts of the response when the necessary permissions and operational conditions are satisfied.
This division of responsibilities is important because the language model does not independently replace the detection systems or create authorization to intervene in customer infrastructure. Sophos supplies the underlying telemetry, integrations, response procedures, and operational safeguards, while the AI components help coordinate investigative reasoning and available actions.
Consider a hypothetical case involving suspicious activity associated with a customer account. An investigation system might correlate identity events with endpoint detections and relevant threat intelligence, determine whether the activity resembles an expected business process or a probable compromise, and prepare evidence supporting a recommended response.
Where sufficient evidence is available and the customer's authorization permits it, parts of that workflow could be completed automatically. An ambiguous investigation or an action that might disrupt business operations would instead require additional review.
This example illustrates the architecture rather than reproducing a specific incident disclosed by Sophos.
The distinction between investigation, planning, and execution also affects how the reported results should be understood. Generating a plausible explanation of suspicious activity is substantially easier than producing a reliable operational decision supported by evidence, and executing that decision introduces additional risks involving permissions, business continuity, and unintended consequences.
The Daybreak integration therefore depends on more than model intelligence. Its effectiveness also reflects Sophos's existing security expertise, threat-intelligence resources, curated workflows, and ability to connect the agents with operational systems that already serve customers.
OpenAI has not disclosed a complete list of the exact model versions, agent configurations, or inference settings responsible for the 89-second result. Although Daybreak provides advanced cybersecurity models to trusted partners, the case study does not establish that one particular publicly identifiable model independently produced the reported improvements.
Nor does it demonstrate that a developer could reproduce the same performance merely by connecting a general-purpose language model to a security API.
··········
AUTOMATED RESPONSE REMAINS SUBJECT TO CUSTOMER AUTHORIZATION AND HUMAN OVERSIGHT.
Sophos retains the same customer-defined operational boundaries whether an investigation is performed by a human analyst or an AI agent.
Managed Detection and Response services differ from conventional security-monitoring products because the provider may investigate threats and take certain actions on behalf of the customer. The extent of that authority depends on the service agreement, technical configuration, and decisions made by the organization receiving protection.
Sophos structures this relationship around three operating modes: Notify, Collaborate, and Authorise. Each establishes a different balance between investigation, customer participation, and delegated response authority.
........
Operating mode | Operational responsibilities |
Notify | Sophos investigates and recommends actions; the customer performs the response. |
Collaborate | Sophos and the customer coordinate before the response is executed. |
Authorise | Sophos may respond directly on the customer's behalf within agreed boundaries. |
........
The distinction is particularly important when agents can interact with security controls rather than merely produce recommendations. Disabling a compromised account, isolating a workstation, or modifying a network rule may contain an attack, but inappropriate execution could also interrupt legitimate business operations.
An agent may correctly identify suspicious behavior while recommending an intervention whose operational consequences depend on information it does not possess. A device might support a critical business process, an account might be shared by several applications, or a network connection might be required for an essential service.
Sophos states that potentially destructive actions remain subject to the appropriate level of human oversight and that cases considered unsuitable for autonomous handling are escalated to security specialists.
A 52% end-to-end automation rate therefore does not mean that human control has been eliminated from the service. The relevant decisions include which workflows are eligible for automation, what actions agents may perform, and when an investigation must be handed to a person with additional context or authority.
Several technical controls are especially important in this type of architecture. Security agents should operate with limited permissions, preserve an auditable record of evidence and actions, distinguish trusted instructions from attacker-controlled data, and prevent model-generated recommendations from overriding established authorization mechanisms.
These are requirements for robust agentic security operations, not a claim that Sophos has publicly documented every specific control in its implementation.
Prompt injection deserves particular attention because cybersecurity agents frequently process untrusted material, including logs, emails, websites, files, and network observations. An attacker may deliberately insert instructions into that material, attempting to influence how the model interprets evidence or chooses subsequent actions.
A reliable system must treat such material as evidence rather than as a source of operational authority. Otherwise, the same capabilities that accelerate an investigation could allow malicious content to interfere with it.
For enterprises adopting AI-assisted MDR, the effectiveness of governance should therefore be measured not only by the proportion of cases completed automatically, but also by the frequency of incorrect interventions, unauthorized-action attempts, escalations, and cases requiring subsequent correction.
··········
THE ECONOMIC ADVANTAGE COMES FROM SCALING INVESTIGATION CAPACITY WITHOUT PROPORTIONAL STAFFING GROWTH.
Faster investigations can improve the operating leverage of managed cybersecurity services, although the reported 96% time reduction cannot be translated directly into an equivalent reduction in costs.
Security operations centers depend on scarce technical expertise. Experienced analysts must distinguish genuine threats from false positives, evaluate unfamiliar activity, understand customer-specific systems, and determine which responses are appropriate under time pressure.
As a provider acquires additional customers, its telemetry volumes and investigation responsibilities generally increase. Traditional expansion often requires additional analysts, specialized training, and management capacity, while demand may fluctuate considerably between ordinary operating periods and major incidents.
Sophos's deployment introduces a different scaling mechanism. Routine investigations that fall within established criteria can be handled by agents, allowing human specialists to spend more time on ambiguous cases, complex attacks, and decisions requiring contextual judgment.
The reported 52% automation rate is significant in this respect because it concerns completed cases rather than the automation of isolated analytical steps. A tool that summarizes security logs may make an analyst more efficient, but a system capable of completing an eligible investigation can remove a much larger portion of the repetitive workload.
The economic effect nevertheless depends on the relationship between four variables: the number of cases processed, the proportion handled successfully without human intervention, the computing cost required by the agents, and the remaining cost of human review and exception handling.
For illustration, consider a hypothetical MDR operation processing 1,500 cases per day. If 52% were resolved end-to-end by AI, approximately 780 cases would be completed through automated workflows, leaving 720 requiring some form of additional handling. This applies Sophos's reported proportion to an illustrative workload; it does not establish the company's actual daily automation volume.
The calculation also does not mean that 780 cases represent 780 times 38 minutes of recoverable analyst labor. The 38-minute figure measures reported elapsed response time rather than the amount of continuous human work devoted to each case, while investigations may overlap or include waiting periods.
A more rigorous economic assessment would measure:
Cost per resolved case: Combined inference, tool execution, platform infrastructure, analyst time, and operational overhead.
First-pass resolution rate: Percentage of investigations completed without reopening or additional escalation.
Analyst intervention rate: Frequency and duration of human involvement in agent-assisted investigations.
Quality-adjusted automation: Successful autonomous resolutions after accounting for errors, missed threats, and inappropriate responses.
Tail response latency: Time required to complete slower or more complex investigations, rather than relying exclusively on the average.
Among these measures, quality-adjusted cost per resolution is particularly important. An automated workflow that closes cases quickly but generates additional false negatives could appear operationally efficient while increasing the customer's exposure to attacks.
Conversely, a system that requires more inference or human verification may still be economically attractive if it produces better decisions and avoids expensive downstream incidents.
The potential commercial benefit for Sophos extends to its managed service partners. Sophos has described a global channel of more than 25,000 partners, including over 7,000 managed service providers, and serves more than 40,000 MDR customers. Distributing AI-assisted investigation capabilities through this infrastructure may allow smaller organizations to benefit from advanced security analysis without building and operating their own frontier-model systems.
However, OpenAI and Sophos have not published the inference expenditure, infrastructure costs, savings in analyst hours, or resulting changes in MDR profitability associated with the deployment. Any claim that operating costs declined by 96%, or that the automation rate translates directly into equivalent staff savings, would therefore be unsupported.
The disclosed figures demonstrate a substantial improvement in reported handling speed and automation coverage, while the financial return remains to be established through additional operational disclosures.
··········
THE DAYBREAK PARTNERSHIP EXTENDS BEYOND MDR TO INCIDENT RESPONSE AND VULNERABILITY VALIDATION.
Sophos is expanding the use of OpenAI's cybersecurity models across managed security services, combining advanced reasoning with the evidence and operational context maintained by its own platform.
The partnership is part of OpenAI Daybreak, an initiative introduced to make advanced cyber capabilities available to trusted defensive organizations and integrate them into products and services already used by enterprises.
The Daybreak Cyber Partner Program, subsequently expanded into a broader defense network, gives participating security providers controlled access to models capable of supporting threat investigations, vulnerability research, and remediation planning.
Rather than providing unrestricted model access to every end customer, the program allows qualified partners to integrate these capabilities into governed workflows, where their own expertise and controls determine how results are used.
Sophos joined the program in June 2026 and has described an expansion covering three areas of managed security operations.
The first is Managed Detection and Response, where models assist analysts in correlating signals across endpoints, identities, networks, email, and cloud environments. This is the area addressed by the October 9 operational performance figures.
The second is Digital Forensics and Incident Response (DFIR), where advanced models can help reconstruct attack timelines, investigate which resources an intruder accessed, and organize the evidence needed for containment, recovery, and possible reporting obligations.
The third includes security advisory and penetration-testing services, where specialists can use models to assess possible attack paths, evaluate whether vulnerabilities are realistically exploitable, and prioritize remediation according to the customer's actual exposure.
Sophos has also announced plans to incorporate OpenAI cyber models into its Managed Risk offering through an exploit-path validation capability. This approach aims to distinguish theoretical vulnerabilities from weaknesses that could plausibly be exploited within a particular environment, using technical evidence and analyst review rather than relying exclusively on generic vulnerability scores.
These activities are related but should not be confused with the MDR automation results. The 89-second average and 52% end-to-end automation rate do not establish equivalent performance for forensic investigations, penetration testing, vulnerability remediation, or other security services.
The broader significance of the partnership lies in the combination of specialized frontier-model reasoning with the customer data, operational integrations, and human expertise needed to make that reasoning actionable.
A model capable of analyzing a vulnerability cannot independently determine the business consequences of taking an application offline, nor can it infer every contractual or regulatory obligation affecting a customer's response.
Security providers retain responsibility for interpreting those constraints and ensuring that automated recommendations remain consistent with the organization's actual environment.
The arrangement also illustrates how frontier AI can be commercialized through managed services instead of direct model subscriptions. Organizations purchasing MDR are primarily buying security outcomes—investigation, response, continuity, and accountability—rather than purchasing tokens or access to a particular AI model.
For OpenAI, partner-based distribution allows advanced models to reach customers that may not have the technical resources or organizational capacity to deploy and govern them independently.
For Sophos, the partnership provides additional computational capabilities that can be incorporated into an existing managed-services business, potentially improving service capacity and differentiation without requiring the company to develop every foundation-model capability internally.
··········
THE RESULTS SHOW OPERATIONAL PROGRESS, BUT DETECTION QUALITY AND REAL-WORLD RISK REDUCTION REMAIN UNMEASURED.
Sophos's reported improvements establish a substantial change in investigation speed, but a complete evaluation also requires evidence about accuracy, missed threats, customer outcomes, and the reliability of autonomous decisions.
The October 9 announcement provides three clear performance measures: average response time, percentage reduction relative to the previous process, and the share of MDR cases handled end-to-end by AI.
It does not provide a complete breakdown of investigation outcomes by case severity, attack technique, customer environment, or complexity. Nor does it report false-positive and false-negative rates, the frequency of incorrectly closed cases, reopening rates, or the number of incidents in which autonomous action produced an operational problem.
These omissions do not invalidate the reported results, but they limit what can reasonably be concluded from them.
A reduction in average investigation duration does not necessarily mean that the most dangerous incidents are handled with the same improvement. Straightforward cases may be particularly suitable for automation, while sophisticated intrusions involving unusual behavior, incomplete telemetry, or multiple compromised systems may continue to require extensive human investigation.
Average figures can also conceal substantial differences between ordinary and exceptional cases. An operation with many rapidly resolved investigations could report an impressive average while still experiencing long delays in complex incidents.
Security teams should consequently examine median and high-percentile response times alongside case severity, escalation frequency, and post-resolution quality.
The reported use of AI across 52% of MDR cases also creates a measurement question: whether the percentage remains stable as agents encounter new customers, previously unseen threats, changing attacker techniques, and increasingly complex enterprise environments.
A mature operational evaluation would follow the agents over time, comparing performance against a consistent human-reviewed reference set and monitoring whether the system continues to make appropriate decisions as the threat environment changes.
For enterprise customers, that evidence would be more useful than a headline automation percentage alone. The practical benefits of faster response depend on whether threats are identified correctly, containment occurs before attackers achieve their objectives, and legitimate operations are not unnecessarily disrupted.
The Sophos deployment nevertheless illustrates an important direction in cybersecurity engineering. AI agents are beginning to operate as components of production security services, gathering evidence, coordinating investigations, and completing authorized workflows at a scale that would be difficult to achieve through manual investigation alone.
The value of this development is not established by speed in isolation, but by the ability to combine that speed with reliable evidence, enforceable permissions, and accountability for operational decisions.
Sophos and OpenAI have demonstrated a reported reduction from 38 minutes to 89 seconds for agent-handled security cases. The next meaningful measure will be whether that acceleration consistently produces more accurate investigations, faster containment of genuine threats, and lower total operating costs without weakening customer control.
··········
FOLLOW US FOR MORE.
DATA STUDIOS
datastudios.org
