Sophos Integrates OpenAI Daybreak to Reduce Threat Investigation Time by 96%

Sophos has integrated OpenAI Daybreak to automate a significant portion of its cybersecurity threat investigations, reducing the average response time for cases handled by AI agents from 38 minutes to 89 seconds. This integration allows Sophos to scale its security expertise across more than 625,000 organizations by leveraging frontier AI to handle routine investigations and response planning.

AI-Driven Automation in Sophos Fusion

Sophos has deployed AI agents built through the Daybreak program within Sophos Fusion, its AI-native cyber defense system. Sophos Fusion integrates sensor data from over 500 third-party integrations and Sophos's own products, processing trillions of daily events into approximately 1,000 to 2,000 cases for investigation across nine security operations centers.

The automation process utilizes a specialized agentic workflow:

  • Investigation Agents: These agents gather customer context, detections, indicators of compromise (IoCs), and relevant threat intelligence for every case.
  • Planning Models: A planning model implements a "plan-execute-review" loop. It constructs an investigation plan, executes the necessary steps, and generates a summary with recommended response actions for human analysts to review.
  • Response Agents: Dedicated agents are capable of carrying out specific parts of the response process.

Performance Gains and Operational Impact

The implementation of OpenAI Daybreak has resulted in a measurable decrease in the time required to resolve security incidents. Previously, the human-led process averaged 38 minutes per case. With the new AI agents, the average response time has dropped to 89 seconds.

Key operational results include:

  • Case Resolution: 52% of Managed Detection and Response (MDR) cases are now resolved end-to-end by AI agents within boundaries calibrated by Sophos analysts.
  • Scalability: Sophos can now scale its capabilities through compute rather than relying on the growth of scarce cybersecurity personnel.
  • Analyst Focus: Human analysts are now able to prioritize threats, exceptions, and high-stakes decisions where their domain expertise is most critical.

Human Oversight and Control Framework

To maintain safety and prevent potentially destructive actions, Sophos maintains three operating modes for its MDR service that apply to both human and AI agents:

  1. Notify: The AI investigates and recommends a response, but the customer retains the final action.
  2. Collaborate: Sophos and the customer work together before any action is taken.
  3. Authorise: Sophos is permitted to respond directly on the customer's behalf.

Sophos ensures that any task the company is not comfortable with an agent handling is passed to a human for judgment.

Strategic Outlook for Cybersecurity Defense

Sophos CTO John Peterson emphasizes that while AI agents are becoming more sophisticated, security leaders must remain focused on fundamentals. He advocates for a layered security approach—including endpoint protection, multifactor authentication (MFA), and network segmentation—because vulnerabilities are being discovered and exploited at an unprecedented scale.

"With programmes like Daybreak, we have an opportunity to stay a step ahead of the attacker community."

Sophos intends to continue expanding the capabilities and range of use cases for its AI agents to further enhance its response capabilities.

Sources