Sophos says agents built through OpenAI’s Daybreak program have reduced the average response time for participating security cases from about 38 minutes to 89 seconds. The company reports that 52 percent of its managed detection and response cases are now resolved end to end by AI.
Sophos Fusion receives sensor data from more than 500 third-party integrations alongside the company’s own products. Trillions of daily events are narrowed to roughly 1,000 to 2,000 cases for nine security operations centers. An investigation agent gathers customer context, detections and threat intelligence, while a planning model creates and reviews a sequence of investigative steps.
Automation does not grant identical authority in every account. Customers choose among notify, collaborate and authorize modes. Potentially destructive actions still pass through the corresponding approval boundary, and cases the system cannot handle confidently move to human analysts.
The performance figures come from Sophos and OpenAI’s case study, not a third-party evaluation. They describe cases where the agents are used and do not show error rates or whether the automated half is systematically easier. Even so, the deployment illustrates where security agents can save time: assembling evidence and applying established playbooks while preserving escalation for uncertain or consequential actions.