# From 38 Minutes to 89 Seconds: How Sophos Uses OpenAI Daybreak for Threat Investigation

Hi, it's Shii-chan! Today's story is about bringing AI agents into security operations. The numbers are impressive, so stick with me!

## What was announced?

OpenAI News published a customer story about the security company Sophos.

Through the OpenAI Daybreak program, Sophos combines OpenAI models with its own threat intelligence, response playbooks, and security expertise. The goal is not just to give analysts another tool, but to scale Sophos's expertise across every customer it protects.

## Why it matters

The article describes frontier AI as affecting both defenders and attackers.

- Advanced models help defenders find and investigate threats faster
- Similar capabilities are spreading to open-weight models, which can help attackers find vulnerabilities and exploit them faster

That is why the defenders' window is narrowing. Sophos protects more than 625,000 organizations.

## What changes

The investigation flow in Sophos Fusion, an AI-native cyber defense system that includes Managed Detection and Response (MDR), has changed.

- Before: investigation and response depended mainly on human expertise, averaging around 38 minutes
- Now: for cases using agents built with Daybreak, the average response time is about 89 seconds
- 52% of MDR cases are resolved end-to-end with AI

According to CTO John Peterson, the old 38-minute average was already better than 96% of professional security operations centers.

## Dive Deep

Here is how it works under the hood.

- Sensor data from more than 500 third-party integrations plus Sophos's own products generates trillions of events every day
- Those are distilled into roughly 1,000 to 2,000 cases for nine security operations centers to investigate
- An investigation agent gathers customer context, detections, IoCs, and relevant threat intelligence for each case
- A planning model builds a plan-execute-review loop: it makes an investigation plan, completes the steps, and writes a summary with recommended response actions for analysts to review
- Other agents can carry out parts of the response

Customers can choose from three operating modes:

- Notify: Sophos investigates and recommends a response, but the customer acts
- Collaborate: Sophos and the customer work together before action is taken
- Authorise: Sophos can respond directly on the customer's behalf

The same boundaries apply whether a person or an agent does the work, and potentially destructive actions still need the right level of human oversight.

## Wrap-up

- Sophos built agents with OpenAI Daybreak
- Average response time for agent-handled cases fell from about 38 minutes to about 89 seconds
- 52% of MDR cases are resolved end-to-end with AI
- Notify, Collaborate, and Authorise modes keep customer judgment at the center
- Peterson advises focusing on fundamentals such as patching, MFA, and network segmentation in a layered approach

This one is for anyone running a SOC or wondering how to use AI agents in security!