Sophos reports faster threat investigations with OpenAI Daybreak agents

Reported gains in investigation time

An OpenAI case study says Sophos reduced average response time for cases using Daybreak agents from about 38 minutes to 89 seconds. It also reports that AI resolves 52 percent of Sophos Managed Detection and Response cases end to end.

These are company-reported operational results for a particular deployment. They do not establish the same improvement for a different organization, a different incident mix or software installed without Sophos’s operating procedures. The workload and the authority given to an agent remain essential context for interpreting the figures.

Agents work with customer context

The case study describes agents that gather case information and threat intelligence, build an investigation plan and prepare recommended actions. The system combines model capabilities with Sophos’s existing security expertise and processes.

For a team evaluating a similar approach, a useful trial would include the cases that require escalation. Measure the time spent obtaining a correct decision as well as the speed of the first response. Keep examples where information is incomplete or the initial recommendation needs revision, since those cases help reveal the limits of automation.

Authority remains a separate choice

Sophos describes Notify, Collaborate and Authorise modes for deciding who takes a response action. The case study says those boundaries apply to work performed by people and agents alike.

That makes response authority a concrete part of the deployment design. A fast investigation can still require someone to decide whether a proposed action is appropriate for the customer. Teams reviewing such a system should be able to identify the evidence behind a recommendation and the permission under which it acts. Evaluate those operating boundaries alongside the reported time savings before expanding the tasks assigned to automation.