Sophos has reduced threat investigation time by 96% using OpenAI models through OpenAI Daybreak, according to an OpenAI customer account published October 9, 2026. The account reports that average response time for cases using AI agents fell from approximately 38 minutes to 89 seconds, while AI resolved 52% of managed detection and response (MDR) cases end-to-end within boundaries set by Sophos analysts.
The deployment combines OpenAI models with Sophos’s threat intelligence, response playbooks and security expertise. Its reported results describe both faster work on cases handled by agents and a substantial share of cases completed with AI. They also come with a clear operational constraint: potentially destructive actions still require human oversight.
What the performance figures measure
OpenAI’s account presents three measures with different scopes:
| Reported measure | Result | Scope stated in the account |
|---|---|---|
| Investigation time | 96% reduction | Investigations using OpenAI models |
| Average response time | Approximately 38 minutes to 89 seconds | Cases using AI agents |
| End-to-end AI resolution | 52% | MDR cases, within boundaries calibrated by Sophos analysts |
The response-time figure applies to cases using agents; it should not be read as an average for every incident Sophos handles. Likewise, the 52% figure describes the share of MDR cases resolved end-to-end with AI, rather than a reduction in the time needed to resolve every case.
These distinctions matter when assessing the deployment. Faster agent-handled cases and broader automation coverage answer different questions about operational performance. The supplied account does not give the measurement period, sample size or case-selection criteria, so it does not establish how the results vary by incident complexity or customer environment.
KuCoin News also reported the figures, explicitly attributing them to OpenAI. That report repeats the vendor’s results; it does not provide a separate performance evaluation.
Models combined with security expertise
OpenAI describes Daybreak as the means through which Sophos combines its models with the security provider’s own intelligence and response playbooks. The evidence supports that integration at a broad level, but does not identify the underlying model versions or explain how agents select tools, access data or execute individual response steps.
There is also a terminology difference between the accounts. KuCoin calls Daybreak a model, while OpenAI describes Sophos using OpenAI models through Daybreak. The latter wording leaves the specific model identity unresolved; the available evidence does not establish a standalone Daybreak model specification.
OpenAI frames the operational benefit as making better use of analysts’ time and allowing Sophos to expand computing capacity without equivalent growth in scarce cybersecurity headcount. That is the vendor’s scaling rationale. The reported timing and automation figures do not, by themselves, quantify staffing savings or operating costs.
Human judgement remains part of the workflow
The automation operates within boundaries calibrated by Sophos analysts. OpenAI’s account says the same boundaries apply whether a person or an agent completes the work, and that potentially destructive actions require the appropriate human oversight.
Sophos chief technology officer John Peterson describes the handoff in the account:
“Anything we don’t feel comfortable with an agent handling gets passed off for human judgement.”
The account does not specify which actions require approval or the criteria used to escalate a case. For security teams assessing the approach, those details remain essential to understanding what end-to-end automation permits in practice.
The strongest supported finding is that Sophos reports substantial speed and automation gains within an analyst-defined operating framework. Whether another security operation could achieve comparable results remains unanswered by the disclosed evidence, particularly without case-selection details, measurement methodology or a fuller description of the agents’ authority.
