Sophos reduces threat investigation time by 96% using OpenAI Daybreak

The system, built on Sophos Fusion, pulls data from more than 500 third‑party integrations, generating trillions of events daily that are distilled into 1,000‑2,000 cases for nine security operations centres. An investigation agent gathers context and a planning model creates a plan‑execute‑review loop, producing summaries and recommended actions for analysts. Sophos reports that 52% of MDR cases are resolved end‑to‑end by AI while still keeping human oversight for potentially destructive actions.

John Peterson, Sophos’ chief technology officer, said the approach lets analysts focus on decisions that need expertise and helps the company scale without expanding scarce security staff. He warned that the same frontier models are also becoming available to attackers, underscoring the need for strong fundamentals such as patching and multi‑factor authentication.