Sophos Says OpenAI Agents Cut Case Response to 89 Seconds

Sophos says agents it built through OpenAI’s Daybreak programme have cut the average response time for the managed detection and response (MDR) cases they handle from around 38 minutes to about 89 seconds, according to a customer story OpenAI published with a video on 9 October 2026.

The cybersecurity company, which says it protects more than 625,000 organisations, now resolves 52% of MDR cases end-to-end with AI, within boundaries calibrated by its analysts, the story says. OpenAI’s title for it: “Sophos cuts threat investigation time by 96%.”

How the Agents Work

According to the story, Sophos Fusion brings together sensor data from more than 500 third-party integrations alongside Sophos’s own products. Those sensors generate trillions of events every day, which Sophos distills into roughly 1,000 to 2,000 cases for its nine security operations centres.

An investigation agent gathers the customer context, detections, indicators of compromise and relevant threat intelligence for each case. A planning model then runs a plan–execute–review loop and produces a summary with recommended response actions for analysts to review, the story says.

“About half of the cases we handle are now being automated by agents we developed using the Daybreak models,” said John Peterson, Sophos’s Chief Technology Officer.

What Daybreak Changes

In OpenAI’s video, Peterson says Daybreak has let Sophos use frontier models to identify vulnerabilities in its own products and to design agents with less restrictive guardrails. He says most of Sophos’s work is in areas that would trip guardrails.

The story says Sophos keeps three operating modes for customers, Notify, Collaborate and Authorise, and that the same boundaries apply whether work is done by a person or an agent. “Anything we don’t feel comfortable with an agent handling gets passed off for human judgement,” Peterson says.

Peterson says the earlier 38-minute average was better than 96% of professional security operations centres. On our arithmetic, 89 seconds against 38 minutes (2,280 seconds) is a reduction of about 96%.

The Structural Read

The gain is on agent-handled cases. The story gives 89 seconds for cases using the agents, against a 38-minute average before.

The work runs as a loop. An investigation agent gathers context and a planning model plans, executes and reviews, with recommended actions going to analysts.

Guardrails were part of the deal. In OpenAI’s video Peterson says Daybreak let Sophos design agents with less restrictive guardrails for security work.

Three Implications

HALF THE QUEUE AUTOMATED Sophos says it now resolves 52% of MDR cases end-to-end with AI.

HUMAN SIGN-OFF BY MODE Customers choose Notify, Collaborate or Authorise, and the same limits apply to agents, per the story.

VENDOR-PUBLISHED FIGURES The 38-minute and 89-second figures come from OpenAI’s customer story and Sophos’s CTO.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Agentic Harness War.

The framework’s starting point: “The surface, not the model, governs autonomy.”

As we read it, Sophos’s three customer modes are that surface: the same OpenAI models act on their own under Authorise and only recommend under Notify, so the setting the customer picks decides how far an agent goes.

What Is Not Established

This is a customer story published by OpenAI, the vendor; we read it in full and the two video segments the clip transcripts give. The 89-second figure covers cases handled by the agents, not every case. The figures have not been independently verified, and we did not contact OpenAI or Sophos.

The Bottom Line

Sophos says agents built through OpenAI’s Daybreak programme cut the average response time for the cases they handle from around 38 minutes to about 89 seconds, and that it now resolves 52% of MDR cases end-to-end with AI, with human judgement kept for actions its analysts are not comfortable leaving to an agent.