Significant Reduction in Investigation Time
On October 9, 2026, Sophos announced that integrating OpenAI Daybreak models into its Sophos Fusion system has dramatically reduced threat investigation times for its Managed Detection and Response (MDR) service. The company reported that the average investigation time for cases using these AI agents has decreased from approximately 38 minutes to about 89 seconds, marking a 96% reduction.
How the Agents are Utilized
Sophos Fusion aggregates sensor data from over 500 third-party integrations alongside its own products. These sensors generate trillions of events daily, which Sophos condenses into roughly 1,000 to 2,000 cases for its nine security operations centers to investigate. An investigation agent collects customer context, detections, indicators of compromise (IoCs), and relevant threat intelligence for each case. A planning model then establishes a plan–execute–review loop: it formulates an investigation plan, executes the necessary steps, and produces a summary with recommended response actions for analysts to review. Other agents can also perform parts of the response.
Automation and Control
Sophos indicates that about half of its cases are now automated by agents developed using the Daybreak models, with 52% of MDR cases achieving end-to-end resolution through AI, all within parameters defined by Sophos analysts.
Operational Modes and Human Oversight
Sophos operates its MDR service in three modes: Notify (Sophos investigates and recommends actions for the customer to take), Collaborate (Sophos and the customer work together before any action is taken), and Authorize (Sophos can respond directly on the customer’s behalf). The company emphasizes that the same boundaries apply whether the work is completed by a human or an agent, ensuring that potentially destructive actions are always routed for human judgment.
Future Directions
According to John Peterson, CTO at Sophos, this approach allows the company to scale its computational capabilities rather than relying solely on increasing cybersecurity personnel. He noted that response capabilities will continue to evolve, and the range of use cases for the agents will expand. Peterson advises security leaders to concentrate on fundamental security practices, including patching, endpoint protection, multifactor authentication, network segmentation, and robust security operations.
Original source: OpenAI News