Sophos Cuts Threat Investigation Time with OpenAI Daybreak

Cybersecurity company Sophos has reduced threat investigation times by 96% using OpenAI Daybreak. Sophos protects more than 625,000 organisations and uses agents built through OpenAI's Daybreak programme in its threat investigations.

Sophos uses a cyber defense system called Sophos Fusion, which includes Sophos Managed Detection and Response (MDR). This system processes sensor data from more than 500 third-party integrations alongside Sophos's own products. Out of the trillions of events generated every day, Sophos distills the data down to roughly 1,000 to 2,000 cases for its nine security operations centres to investigate.

Before implementing Daybreak, investigating and responding to a case took Sophos an average of 38 minutes. With the deployment of agents built through the Daybreak programme, the average response time for cases using those agents fell to 89 seconds. Sophos now resolves 52% of its MDR cases end-to-end using AI, within boundaries calibrated by Sophos analysts.

The AI-driven process relies on an investigation agent to gather customer context, detections, indicators of compromise, and threat intelligence. Following this, a planning model initiates a plan–execute–review loop to build an investigation plan, complete the steps, and produce a summary with recommended actions for analysts to review.

To maintain control, Sophos operates its MDR service under three modes: Notify, Collaborate, and Authorise. Potentially destructive actions still require human oversight; Sophos says anything it is not comfortable with an agent handling is passed to human judgement.