Cybersecurity Revolution: Sophos cuts threat investigation time by 96% with OpenAI AI

The new cybersecurity battlefield

In the current landscape, the digital arms race has reached a new level. While frontier AI technologies empower defenders to locate and mitigate threats with unprecedented agility, they also provide attackers with sophisticated tools to discover vulnerabilities and accelerate system exploitation. In this context of an increasingly narrow "defense window," Sophos, a global giant protecting more than 625,000 organizations, has found a powerful ally to level the playing field: the OpenAI Daybreak program.

Integrating OpenAI's capabilities with Sophos' vast threat intelligence and response playbooks is not just a tool upgrade; it is a fundamental shift in how human expertise is scaled to protect businesses around the world.

The operational impact of Daybreak

Sophos operates under colossal pressure. Its AI-native defense system, Sophos Fusion, aggregates data from over 500 third-party integrations, processing trillions of events daily. Of these, about 1,000 to 2,000 critical cases are filtered daily to be investigated by the company’s nine security operations centers (SOCs).

Before the implementation of Daybreak's artificial intelligence, the investigation process was dependent on an intensive human workload. John Peterson, CTO at Sophos, highlights that the company already had enviable performance, with an average response time of approximately 38 minutes — a metric superior to 96% of professional security operations centers around the globe. However, in cybersecurity, every second counts.

The transformation in numbers:

• Reduction in investigation time: From an average of 38 minutes to an impressive 89 seconds.
• Automation efficiency: 52% of all Managed Detection and Response (MDR) cases are now handled by autonomous agents.
• Scalability: The ability to apply Sophos' technical expertise consistently across all clients without sacrificing accuracy.

How the "magic" of AI agents works

The transition to intelligent automation does not replace the human analyst, but repositions them into a role of strategic oversight. The agents developed through Daybreak operate in a continuous cycle of planning, execution, and review:

1. Contextual Collection: The investigation agent automatically gathers client context, detections, indicators of compromise (IoCs), and threat intelligence relevant to each specific case.
2. Planning Modeling: A planning model defines the best investigation strategy, executes the necessary steps, and compiles a summary with recommended response actions.
3. Human Oversight: Analysts review the plan executed by the agent and approve the final actions, ensuring that the human touch and critical judgment remain at the center of decisions.

Preserving the human factor

A crucial point emphasized by Sophos is that automation does not mean the end of human intervention. On the contrary, by removing the repetitive manual work of triage and data collection, the technology allows security experts to focus on what really matters: complex analysis and long-term defense strategy.

"Sophos brings the domain expertise and know-how to combat attacks at scale. Programs like Daybreak and companies like OpenAI bring the frontier intelligence that allows us to take that expertise and scale it to support all of our customers," says Peterson.

The future of proactive defense

This move by Sophos exemplifies the industry trend of enterprise AI: the transition from generalist models to specialist agents highly trained in specific niches, such as real-time threat monitoring. With the automation of half of its MDR operations, Sophos is not only gaining time; it is ensuring that its response to cyberattacks is as fast as the evolution of cybercriminals themselves.

For companies, the message is clear: in a future where attacks are automated by AI, the only way to survive is a defense that combines decades of human experience with the speed and processing power of cutting-edge artificial intelligence. Sophos has proven that this combination is not only possible but extremely effective.