Sophos cuts threat investigation time by 96% with OpenAI Daybreak

Cybersecurity firm Sophos is utilizing OpenAI's Daybreak program to integrate advanced frontier intelligence with its own threat intelligence, response playbooks, and four decades of domain expertise. Operating at the center of Sophos Fusion, the company's AI-native cyber defense system, the new capabilities are designed to scale human expertise across more than 625,000 client organizations. Sensor data from over 500 third-party integrations alongside proprietary products generate trillions of events daily, which are distilled into thousands of cases for investigation. Prior to Daybreak, investigating and responding to a case averaged roughly 38 minutes. According to Sophos Chief Technology Officer John Peterson, the integration of Daybreak-built investigation and planning agents has reduced the average response time for cases using these agents to approximately 89 seconds, while automating about 52 percent of Managed Detection and Response cases end-to-end. To maintain safety and security, Sophos has embedded three distinct operating modes—Notify, Collaborate, and Authorise—giving customers control over how responses are executed. The same operational boundaries apply whether tasks are handled by humans or AI agents, ensuring that potentially destructive actions still require human oversight. Peterson notes that Sophos plans to continue expanding the capabilities and use cases of its AI agents to stay ahead of attackers, while advising other security leaders to maintain strong security fundamentals and a layered defense approach.