Sophos cuts AI-assisted threat investigation time to 89 seconds

What is changing?

Sophos connected AI agents built through OpenAI's Daybreak program to its managed detection and response service. The company says average investigation and response time for cases using those agents fell from roughly 38 minutes to 89 seconds, a reduction of about 96%.

Inside Sophos Fusion, an investigation agent gathers customer context, detections, indicators of compromise, and relevant threat intelligence. A planning model then runs a plan–execute–review loop and prepares a summary with recommended response actions for an analyst.

Sophos reports that 52% of MDR cases can be resolved end to end by AI within boundaries calibrated by its analysts. Potentially destructive actions remain subject to customer settings and human oversight.

These are operational results reported by Sophos rather than an independent benchmark. Even so, the deployment shows how security agents can combine evidence gathering, planning, execution, and human approval in one workflow.