Sophos Reduces Threat Investigation Time to 89 Seconds with OpenAI Daybreak Agents
Sophos has reduced its average threat investigation time from 38 minutes to 89 seconds by deploying AI agents built through the OpenAI Daybreak program. The cybersecurity firm, which protects over 625,000 organizations, reports that these agents now resolve 52% of its Managed Detection and Response (MDR) cases end-to-end. This deployment marks a significant shift in how security operations centers (SOCs) operationalize frontier artificial intelligence to handle high-volume telemetry and accelerate defensive workflows.
How OpenAI Daybreak Integrates with Sophos Fusion
OpenAI Daybreak is not a single model release. The initiative encompasses multiple advanced iterations, including the general-purpose GPT-5.5, GPT-5.5 with Trusted Access for Cyber (TAC), GPT-5.5-Cyber, and the Codex Security code-review assistant. Willie Tejada, SVP and GM of Cloud Native Security Fabric at Aviatrix, told the publication that the initiative is intentionally broad because Daybreak is "a platform play, not a model announcement". The platform aims to help defenders build editable threat models, discover vulnerabilities in isolated environments, and validate patches directly within code repositories.
Sophos applies these capabilities within Sophos Fusion, its AI-native cyber defense system that underpins its MDR service. Fusion aggregates sensor data from more than 500 third-party integrations alongside Sophos products. These sensors generate trillions of events every day, which the system distills into roughly 1,000 to 2,000 actionable cases for its nine security operations centers to investigate.
The Daybreak agents handle these cases through a structured, multi-step workflow. An investigation agent first gathers the customer context, detections, indicators of compromise (IoCs), and relevant threat intelligence for each specific case. A planning model then creates a plan-execute-review loop: it builds an investigation plan, completes the necessary steps, and produces a comprehensive summary with recommended response actions for analysts to review. Other specialized agents can subsequently carry out specific parts of the response.
Why Sophos Adopted Frontier AI for Security Operations
The rapid integration of frontier AI into security operations is a direct response to the dual-use nature of these models. Contrast Security notes that Daybreak changes the economics of vulnerability discovery in two directions. On the offensive side, AI progress makes it faster and cheaper for attackers to build working exploits from publicly disclosed vulnerabilities. On the defensive side, security teams gain tools to scan codebases at AI scale and validate whether a finding is genuinely exploitable.
This dynamic compresses the time between a flaw being disclosed and exploited, forcing defenders to accelerate their own response mechanisms. A Sophos press release highlights that “frontier models are reshaping cyber conflict” by accelerating exploitation timelines. Sophos joined the OpenAI Daybreak Cyber Partner Program in June 2026 to bring these capabilities directly to the organizations it defends worldwide, ensuring it has the architecture to operationalize them safely at scale.
Sophos Chief Technology Officer John Peterson emphasized the necessity of scaling human expertise. "We see a huge variety of different attacks," Peterson said. "We’ve cultivated vast expertise in combating them over four decades in the cybersecurity business." By leveraging Daybreak, Sophos can scale its compute and analytical capabilities rather than relying exclusively on the growth of scarce cybersecurity headcount.
"Sophos brings the domain expertise and the know-how to combat attacks at scale." Programmes like Daybreak, and companies like OpenAI, bring frontier intelligence that allows us to take that domain expertise and scale it to support all of our customers. — John Peterson, CTO, Sophos
What the 96% Reduction in Response Time Means for SOC Analysts
Before the deployment of Daybreak agents, investigating and responding to a case depended primarily on human expertise. The previous average response time of 38 minutes was already a strong metric; Peterson noted it was better than 96% of professional security operations centers. Dropping that average to 89 seconds fundamentally alters the daily workflow of SOC analysts.
This drastic reduction does not eliminate the need for human analysts; rather, it reallocates their attention. By automating 52% of MDR cases end-to-end, the system removes the burden of repetitive, high-volume triage. Analysts are freed to focus on proactive threat hunting and complex incident response. As outlined in Sophos’s threat hunting methodology, proactive hunting assumes an attacker is already inside the environment and requires deep telemetry analysis to uncover stealthy malicious activity. AI agents handle the initial data distillation, allowing human hunters to focus on the behavioral logs and nuanced indicators that automated systems might miss.
To ensure operational safety, Sophos built strict customer control into its MDR service through three operating modes: Notify, Collaborate, and Authorise. In Notify mode, Sophos investigates and recommends a response, but the customer acts. In Collaborate mode, both parties work together before action is taken. In Authorise mode, Sophos can respond directly on the customer’s behalf.
These boundaries apply identically whether the work is completed by a human or an AI agent. "Anything we don’t feel comfortable with an agent handling gets passed off for human judgement," Peterson confirmed. Potentially destructive actions still require the appropriate level of human oversight, ensuring that automated speed does not compromise network stability or customer trust.
How Daybreak Compares to Other AI Cybersecurity Initiatives
The deployment of AI agents in enterprise security is part of a broader industry shift. Gartner analyzed OpenAI Daybreak alongside Anthropic Mythos in a May 2026 webinar, noting that Daybreak represents an early but notable shift in how AI may be applied to cybersecurity defense. The initiative is positioned to help organizations find, validate, and remediate vulnerabilities faster and at greater scale by combining frontier models with AI coding assistants.
A key differentiator for Daybreak is its integration with Codex Security, which Contrast Security identifies as the agentic harness for the platform. This integration allows Daybreak to support secure code review, threat modeling, patch validation, dependency risk analysis, and remediation guidance. The goal is to bring these workflows into the everyday development loop so that software becomes more resilient from the start, addressing vulnerabilities before they reach production.
This approach directly tackles a critical gap in application security. Contrast Labs’ research indicates that “the average application accumulates new vulnerabilities faster” than security teams can close them. AI-scale discovery without better context widens this gap, making platforms like Daybreak necessary to validate findings and suggest fixes within a single workflow.
By partnering with established defenders like Sophos, OpenAI is expanding Daybreak from internal testing to defensive tools delivered through trusted partners. This scoped integration ensures that the AI operates within the strict boundaries of enterprise security policies and managed services, rather than offering raw, unfiltered model access to end customers. Early focus areas remain on defensive workflows with Sophos analysts and controls firmly in the loop.
Despite the rapid advancement of AI agents in threat investigation, Peterson advises security leaders to maintain a focus on foundational practices. He emphasizes a layered security approach that includes endpoint protection, multifactor authentication (MFA), network segmentation, and strong security operations. "Patches are only ever going to include vulnerabilities that are known by the vendor," Peterson noted, underscoring that while AI automation drastically accelerates response times, it supplements rather than replaces comprehensive, fundamental security hygiene.
