Sophos has incorporated OpenAI Daybreak models into its security operations to accelerate threat investigations and scale protections across its customer base. John Peterson, Chief Technology Officer at Sophos, says the company protects more than 625,000 organisations across industries and regions and draws on four decades of cybersecurity experience.
What the solution comprises
At the centre of the effort is Sophos Fusion, the company’s AI-native cyber defence platform, which includes Sophos Managed Detection and Response (MDR). Fusion aggregates sensor data from over 500 third-party integrations alongside Sophos’s own products. Those sensors generate trillions of events each day, which Sophos distils into roughly 1,000 to 2,000 cases for its nine security operations centres (SOCs) to investigate.
Using OpenAI Daybreak, Sophos built agents that automatically gather customer context, detections, indicators of compromise (IoCs) and relevant threat intelligence for each case. A planning model then runs a plan–execute–review loop: it builds an investigation plan, performs the steps, and produces a summary with recommended response actions for analysts to review. Other agents can carry out parts of the response actions.
Impact of Daybreak agents
- Prior to Daybreak, Sophos’s human-led investigation process averaged about 38 minutes per case — a level John Peterson says outperformed 96% of professional SOCs. For cases using the Daybreak-built agents, average response time has fallen to approximately 89 seconds.
- Sophos reports that 52% of MDR cases are now resolved end-to-end with AI, operating within boundaries calibrated by Sophos analysts.
Customer control and safety boundaries
Sophos has implemented three operating modes in MDR to preserve customer control:
- Notify: Sophos investigates and recommends a response, but the customer takes action.
- Collaborate: Sophos and the customer work together before acting.
- Authorise: Sophos may respond directly on the customer’s behalf.
Those same boundaries apply whether a human or an agent completes the work. Sophos uses automation to move faster and free analyst time, but potentially destructive operations still require appropriate human oversight. "Anything we don’t feel comfortable with an agent handling gets passed off for human judgement," Peterson confirms.
Why this matters
The integration delivers a faster and more consistent investigation experience for customers and allows Sophos to scale using compute rather than equivalent increases in scarce cybersecurity headcount. It also returns analysts’ attention to exceptions, decisions and threats where their expertise is most valuable.
Peterson says Sophos will continue to expand agent capabilities and widen the range of use cases they address, with response capabilities becoming more sophisticated over time. He adds that programmes such as Daybreak give the company an opportunity to remain a step ahead of attackers.
Advice for security leaders
Peterson advises security leaders to focus on security fundamentals, including patching, while recognising that patches only address vulnerabilities known to vendors. He recommends a layered security approach that combines endpoint protection, multifactor authentication (MFA), network segmentation and strong security operations, noting that vulnerabilities are being discovered and exploited at an unprecedented rate and scale.
