Sophos cuts threat investigation time using OpenAI Daybreak
Cybersecurity firm Sophos has integrated OpenAI's Daybreak programme into its defense systems, drastically shrinking average response times while maintaining strict human oversight.
Radwan AbdulhadiEditor and technology writer
The Shifting Cybersecurity Landscape
As frontier AI continues to evolve, it is changing cybersecurity on both sides. Advanced models help defenders find and investigate threats at a much faster pace, but those same capabilities are also spreading to open-weight models, granting attackers new avenues to discover vulnerabilities and accelerate exploitation.
To stand in the way of these threats, cybersecurity provider Sophos protects more than 625,000 organizations across various sectors and regions. According to John Peterson, the company's Chief Technology Officer, Sophos brings four decades of domain expertise and deep operational know-how to combat attacks at scale.
Integrating OpenAI Daybreak into Sophos Fusion
Through OpenAI Daybreak, Sophos combines frontier intelligence with its own proprietary threat intelligence, response playbooks, and security expertise. Rather than simply giving analysts another standalone tool, the objective is to scale the impact of Sophos's expertise across every single customer under its protection.
At the center of this integration is Sophos Fusion, the company's AI-native cyber defense system that includes Sophos Managed Detection and Response (MDR). The platform aggregates sensor data from over 500 third-party integrations and internal products, generating trillions of daily events that are distilled into roughly 1,000 to 2,000 cases for the security operations centers to investigate.
Automating Investigations and Response Loops
The deployment of specialized AI agents built through the Daybreak framework has fundamentally changed how cases are handled. An investigation agent gathers necessary customer context, detections, indicators of compromise, and relevant threat intelligence. A planning model then establishes a continuous plan-execute-review loop to formulate an investigation plan, complete the necessary steps, and produce a summary with recommended response actions for human analysts.
Prior to implementing these capabilities, investigating and responding to cases relied almost entirely on human expertise. The legacy process averaged around 38 minutes per case, which Peterson notes was already performing better than 96% of professional security operations centers. With the new agents, the average response time has dropped precipitously to roughly 89 seconds, while about half of all handled cases are now fully automated.
Maintaining Human Oversight and Control
To ensure safety and build trust, Sophos has built customer control directly into its MDR service through three distinct operating modes. Under the Notify mode, Sophos investigates and recommends a response while the customer acts. In the Collaborate mode, Sophos and the customer work together before executing an action. Finally, under the Authorise mode, Sophos is permitted to respond directly on the customer's behalf.
The same operational boundaries apply whether a task is completed by a human analyst or an AI agent. While automation allows the company to move quickly and make better use of scarce cybersecurity headcount, potentially destructive actions still require the appropriate level of human judgment. Any task that falls outside comfort thresholds is escalated directly to human personnel.
Future Outlook and Security Fundamentals
Looking ahead, Sophos plans to continue expanding the capabilities of its AI agents, making response mechanisms more sophisticated and broadening the range of addressed use cases. Peterson emphasizes that embracing such programs provides a vital opportunity to stay a step ahead of malicious attacker communities.
Alongside technological advancements, Peterson advises security leaders to return to core security fundamentals, including comprehensive patching, a layered security approach incorporating endpoint protection, multifactor authentication, network segmentation, and robust security operations to manage rapidly evolving vulnerabilities.
Sources
- OpenAI NewsSophos cuts threat investigation time by 96% with OpenAI Daybreak
Continue chronologically
Related entity coverage
Related stories
Mistral Says Le Chonk Leapfrogs China in AI Race
French AI lab Mistral claims its refined open-weight model Le Chonk matches or outperforms leading systems from DeepSeek and Z.ai in coding and cybersecurity.
OpenAI Prepares New Security Sprint With Cathedral Systems
OpenAI announces its next internal security sprint in partnership with Cathedral Systems to test and strengthen its AI defenses and systems.
Greptile expands bug detection capabilities with GPT-6 Astra
Greptile uses GPT-6 Astra's computer use capabilities to automate user workflow and application testing at scale, going beyond traditional code reviews.
Third Moment Research Runs 10,000 AI Agents for 36+ Hours
Discover how Third Moment Research uses OpenAI models like GPT-6 Astra and Codex to run thousands of autonomous AI agents for days.
