Sophos Cut Threat Investigation Time by 96%

The 38-Minute Problem That Defined an Industry

The cybersecurity industry has spent decades optimizing human analysts — hiring more of them, training them harder, building dashboards to help them move faster. That entire paradigm is now obsolete. Not "under pressure." Not "evolving." Obsolete.

Sophos just published the numbers that prove it. What they built with OpenAI's Daybreak program doesn't just speed up the old process — it replaces the bottleneck entirely. The specifics of how they did it, and what the architecture actually looks like under the hood, are worth understanding carefully before you decide what it means for your own operations.

Before October 2026, Sophos already had one of the fastest threat investigation processes in the industry. According to the company's Chief Technology Officer John Peterson, their 38-minute average investigation time outperformed 96% of professional security operations centers globally. That was a benchmark most organizations would envy.

Then they cut it by 96%.

The result: cases handled by AI agents now average 89 seconds from alert to recommended response. That's not a marginal improvement on an existing workflow. It's a different category of operation entirely — one where the constraint is no longer analyst bandwidth, but the speed of compute.

What OpenAI Daybreak Actually Is

OpenAI Daybreak is a program that gives trusted cybersecurity partners controlled access to frontier AI models specifically designed for security use cases. It's not a product you can buy off the shelf. It's a structured collaboration — OpenAI provides the model capabilities, and the partner brings the domain expertise, the threat intelligence, and the operational context.

For Sophos, that division of labor was the key design principle. As Peterson described it, Sophos brings four decades of accumulated expertise in combating attacks at scale. Daybreak brings the frontier intelligence that allows that expertise to be applied consistently, instantly, and across every customer simultaneously — rather than being rationed by the number of analysts on shift.

The goal wasn't to give analysts another tool. It was to make the expertise of every Sophos analyst available to every customer, at the same moment, without the queue.

This distinction matters for any executive thinking about AI automation. The value isn't in replacing human judgment — it's in removing the serialization bottleneck that forces human judgment to happen one case at a time.

Inside Sophos Fusion: The Architecture Behind the Numbers

The operational core of this deployment is Sophos Fusion, the company's AI-native cyber defense system that encompasses its Managed Detection and Response (MDR) service. Understanding its structure explains why the results are as dramatic as they are.

The data funnel

Sophos Fusion aggregates sensor data from more than 500 third-party integrations alongside Sophos's own product telemetry. Those sensors collectively generate trillions of events every day. The system distills that volume into roughly 1,000 to 2,000 actionable cases, distributed across nine security operations centers for investigation.

That funnel — trillions of raw events compressed into a manageable case queue — was already automated before Daybreak. What Daybreak changed was what happens to each case once it enters the queue.

The two-agent workflow

Each case now passes through a two-stage agent architecture:

• Investigation agent — assembles everything relevant to the case: customer environment context, detection records, indicators of compromise (IoCs), and applicable threat intelligence. This is the evidence-gathering phase that previously required an analyst to open multiple tools, correlate data manually, and build a picture from scratch.

• Planning model — runs a plan–execute–review loop. It constructs an investigation strategy, executes the available steps through the surrounding security infrastructure, evaluates the results, and produces a structured summary with recommended response actions for analysts to review.

Other specialized agents can then carry out parts of the actual response — within boundaries that Sophos analysts define and adjust. Potentially destructive actions remain under human oversight. The system doesn't act autonomously on high-stakes decisions; it acts autonomously on the investigative work that consumed most of the 38 minutes.

Why this architecture scales

The elegance of this design is that it separates volume work from judgment work. Evidence gathering, correlation, and initial triage are volume work — repetitive, rule-governed, and exhausting at scale. Deciding whether to isolate a machine or revoke credentials is judgment work — contextual, consequential, and genuinely requiring human expertise.

By automating the former, Sophos freed its analysts to focus entirely on the latter. The result is that 52% of MDR cases are now resolved end-to-end by AI, with no analyst involvement required. The other 48% still benefit from the speed of automated investigation — analysts receive a complete, structured brief in seconds rather than building it themselves over half an hour.

The Numbers in Context

Three metrics define this deployment, and each deserves a precise reading:

Metric	Before Daybreak	After Daybreak
Average investigation time	~38 minutes	~89 seconds
Reduction in investigation time	—	96%
MDR cases resolved end-to-end by AI	0%	52%

The 96% reduction applies specifically to cases handled by the AI agents — not to every security event across Sophos's entire customer base. The 52% automation figure means that for those cases, no human analyst needs to be involved at any stage. These are the company's own operational metrics, reported on October 9, 2026, and they reflect a live production deployment serving more than 625,000 organizations globally.

The scale context is important: Sophos isn't a startup running a pilot. It's a company that has been in cybersecurity for four decades, protecting organizations across sectors and regions, processing trillions of sensor events daily. These numbers come from a production system at enterprise scale.

When your baseline already beats 96% of the industry, and you still cut it by 96% again — that's not optimization. That's a structural change in what's possible.

What This Means for SOC Automation Beyond Cybersecurity

The Sophos case is a cybersecurity story on the surface. Underneath, it's a blueprint for any operation that runs on high-volume, time-sensitive case work — and that description fits a lot of business functions beyond security.

Think about what the Sophos architecture actually does: it takes a large volume of structured and unstructured signals, filters them into actionable cases, assigns each case to an agent that gathers context and builds a recommended action, and routes only the genuinely ambiguous decisions to a human. That pattern applies to compliance monitoring, procurement approvals, customer escalations, financial anomaly detection, and contract review — anywhere the bottleneck is analyst bandwidth rather than the complexity of the underlying decision.

The lesson isn't "deploy AI agents in your SOC." The lesson is that the architecture of separating volume work from judgment work, and automating the former at scale, produces order-of-magnitude efficiency gains — not incremental ones. If you're evaluating where AI agents can move the needle in your own operations, the Sophos model offers a concrete methodology: identify the high-volume, rule-governed preparation work that precedes every human decision, and automate that layer first.

For executives considering this path, the AI ROI Framework offers a structured way to quantify the business case before committing to a build. And if you're weighing which agent architecture fits your specific use case, the comparison of LangChain vs CrewAI vs AutoGen covers the technical tradeoffs in practical terms.

The Human Oversight Question

One of the most important design decisions in the Sophos deployment is what they chose not to automate. Potentially destructive actions — isolating systems, revoking access, deleting files — remain under human control. Analysts define the boundaries within which agents operate, and those boundaries can be adjusted as confidence in the system grows.

This isn't a limitation of the technology. It's a deliberate architectural choice that reflects a mature understanding of where AI agents create value and where they create risk. An agent that acts autonomously on a false positive in a cybersecurity context can cause more damage than the original threat. The same logic applies in any business process: the value of automation is highest where the cost of an error is low and the volume is high.

The Sophos model suggests a practical principle for any AI automation rollout: start by automating the investigative and preparatory work, keep humans in the loop for consequential actions, and expand the automation boundary incrementally as the system proves its accuracy. This approach also makes it far easier to get organizational buy-in — analysts who see AI handling the tedious evidence-gathering work tend to become advocates, not resistors.

Lessons for Business Leaders Automating Critical Operations

The Sophos case offers several concrete takeaways for executives thinking about AI automation in their own organizations:

Start with the preparation layer, not the decision layer. The 38 minutes Sophos saved weren't spent on hard decisions — they were spent gathering evidence to make those decisions possible. In most business processes, the same pattern holds: the majority of time goes to assembling context, not to the judgment call itself.

Measure the right baseline. Sophos knew their 38-minute average was already elite. That precision mattered — it meant they could measure the actual impact of the change, not just claim improvement. Before deploying agents, establish a clear, quantified baseline for the process you're automating.

Design for human-AI handoff, not human replacement. The 52% full automation rate is impressive, but the 48% that still involves humans is equally important. The system is designed so that when a case exceeds the agent's confidence threshold, it hands off a complete brief rather than a raw alert. That handoff design is what makes the human oversight meaningful rather than nominal.

Scale expertise, not headcount. Sophos's framing — that the goal was to scale the impact of their analysts' expertise, not to replace analysts — is the right mental model for any knowledge-intensive operation. AI agents don't make your best people redundant; they make your best people's judgment available everywhere, simultaneously.

When a CEO can walk into a board meeting and show that a critical operational process now runs at 96% greater efficiency, with documented methodology and live production metrics, the conversation shifts. It stops being about whether AI is worth exploring and starts being about which processes to transform next. That's the kind of clarity that builds confidence — not just in the technology, but in the leader who deployed it.

There's also something quieter that happens when you've automated the right layer of a critical process: the constant background anxiety of "are we keeping up?" goes away. Operations that once felt like firefighting become predictable. That shift — from reactive to systematic — is what executives who've done this describe as the real return on investment.

FAQ

What is OpenAI Daybreak and how does it differ from standard OpenAI products? OpenAI Daybreak is a partner program that gives trusted cybersecurity companies controlled access to frontier AI models optimized for security use cases. Unlike standard OpenAI API access, Daybreak is a structured collaboration where the partner integrates the models into their existing security infrastructure, threat intelligence, and operational workflows — rather than building from scratch.

Does the 96% reduction mean all Sophos investigations are now automated? No. The 96% reduction applies to the average handling time for cases processed by the AI agents. Separately, 52% of MDR cases are now resolved end-to-end by AI with no human involvement. The remaining cases still benefit from automated investigation and briefing, but require human judgment for the final response decision — particularly for potentially destructive actions.

How does Sophos Fusion handle the volume of data involved? Sophos Fusion aggregates telemetry from more than 500 third-party integrations alongside Sophos's own products, processing trillions of events daily. The system distills this into roughly 1,000 to 2,000 actionable cases per day, which are then distributed across nine security operations centers. The AI agents handle the investigation and triage of those cases.

Can this architecture be applied outside of cybersecurity? The underlying pattern — high-volume signal ingestion, automated evidence gathering, structured briefing for human decision-makers — is applicable to any process where the bottleneck is analyst bandwidth rather than decision complexity. Compliance monitoring, financial anomaly detection, procurement review, and customer escalation management all share structural similarities with the SOC workflow Sophos automated.

What safeguards prevent the AI agents from taking harmful actions? Sophos analysts define operational boundaries within which the agents can act. Potentially destructive actions — such as isolating systems or revoking credentials — require explicit human approval. The boundaries are configurable and can be expanded incrementally as confidence in the system's accuracy grows. This design keeps human judgment in the loop for high-stakes decisions while automating the preparatory work.

How long did it take Sophos to deploy this system? The official case study published by OpenAI on October 9, 2026 does not specify the full deployment timeline. Sophos joined the OpenAI Daybreak Cyber Partner Program in June 2026, suggesting the production results were achieved within a few months of the partnership beginning.

---

The Sophos case doesn't just demonstrate what AI agents can do in cybersecurity — it demonstrates what a well-designed human-AI workflow looks like at production scale. The architecture is replicable. The methodology is documented. The results are live.

If you're thinking about where this model applies in your own operations — which processes are bottlenecked by evidence-gathering rather than judgment, and what a 96% efficiency gain would mean for your team — ask our AI agent directly. It's a faster way to map the opportunity than starting from a blank page.