Information technology / Cybersecurity
Sophos: Investigating and responding to threat cases in a managed detection and response (MDR) service
- Company
- Sophos
- Country
- United Kingdom
- Adoption stage
- In operation
- Source published
- Date basis
- The date the source was published. It can differ from the date adoption started.
- How the source was checked
- Read the full source text
The work problem
According to a customer story OpenAI published on October 9, 2026, Sophos protects more than 625,000 organisations across sectors and regions. Frontier AI models help defenders find threats faster, but as the same capabilities spread to open-weight models, attackers can also discover and exploit vulnerabilities faster. Sophos’s managed detection and response (MDR) service brings together sensor data from more than 500 third-party integrations and its own products, and Sophos distills the trillions of events the sensors generate every day into roughly 1,000 to 2,000 cases for its nine security operations centres to investigate. Before Daybreak, investigating and responding to a case depended primarily on human expertise and took about 38 minutes on average, a level that Chief Technology Officer John Peterson said was better than 96% of professional security operations centres.
Technology and data
Through OpenAI’s Daybreak programme, Sophos combined OpenAI models with its own threat intelligence, response playbooks and security expertise and put agents into MDR case handling in Sophos Fusion, its AI-native cyber defense system. An investigation agent gathers the customer context, detections, indicators of compromise (IoCs) and relevant threat intelligence for each case, and a planning model builds an investigation plan, completes the steps, reviews them and produces a summary with recommended response actions for analysts to review. Other agents can carry out parts of the response. Customers set the scope of control through three operating modes, notify, collaborate and authorise, the same boundaries apply whether a person or an agent does the work, and potentially destructive actions still go through the right level of human oversight. Peterson said anything the company does not feel comfortable with an agent handling is passed to human judgement.
Results
According to the customer story, the average response time for cases using agents fell from about 38 minutes to about 89 seconds, which OpenAI presents as a 96% reduction in investigation time. Sophos said AI resolves 52% of MDR cases end to end within boundaries calibrated by its analysts. Peterson said about half of the cases the company handles are now automated by agents built with the Daybreak models. The company explained that this approach gives customers faster and more consistent investigations, lets Sophos scale through compute rather than equivalent growth in scarce cybersecurity headcount, and lets analysts focus on the threats, exceptions and decisions where their expertise matters most.
Limits and open questions
The customer story does not disclose the error rate of agent judgments, the share of results analysts corrected or the measurement period. The 89 seconds is the average only for cases that used agents.
Sources
- Sophos cuts threat investigation time by 96% with OpenAI Daybreakopenai.com, Accessed
Compiled from public sources. These are not results from ATF Works customers.