Sophos cuts threat investigation time by 96% with OpenAI Daybreak

Why it matters

Sophos, a cybersecurity company protecting hundreds of thousands of organisations, has used OpenAI Daybreak to build AI agents that investigate and respond to threats far faster than its previous human-led process. The agents operate within Sophos Fusion, its AI-native defense system, which consolidates sensor data from a large number of third-party integrations into cases handled by its security operations centres. An investigation agent assembles customer context, detections, indicators of compromise and threat intelligence, while a planning model runs a plan-execute-review loop and produces recommended response actions. Sophos now resolves a majority of its Managed Detection and Response cases end-to-end with AI, though potentially destructive actions still require human judgement under the same operating modes that govern human analysts. CTO John Peterson frames the partnership as a way to scale Sophos's decades of domain expertise across its entire customer base using OpenAI's frontier models, rather than depending on scarce cybersecurity hiring. He says Sophos intends to broaden the agents' response capabilities and use cases over time.