Cyber Security

Sophos says OpenAI Daybreak cut MDR investigation time from 38 minutes to 89 seconds

Sophos says OpenAI Daybreak cut MDR investigation time to 89 seconds while keeping customer response controls intact.

#OpenAI #AI security #MDR #Sophos #SOC automation

CyberOGZ Team • October 12, 2026 • 2 views • 3 min read

Format News Brief

Read Time 3 min

Category Cyber Security

Updated Oct 12, 2026

OpenAI published a new Sophos case study on October 9 saying the cybersecurity vendor has used OpenAI Daybreak to compress managed detection and response investigations from roughly 38 minutes to about 89 seconds for cases handled by its AI agents. Sophos also says 52% of MDR cases can now be resolved end to end by AI within boundaries set by its analysts and customers.

The work centers on Sophos Fusion, the company’s AI native cyber defense system for MDR. According to OpenAI, Fusion combines Sophos products with more than 500 third party integrations. Those signals produce trillions of events each day, which Sophos narrows into roughly 1,000 to 2,000 cases for nine security operations centers to investigate.

What Changed In The Workflow

The Daybreak based workflow is not described as a fully independent security team. OpenAI says an investigation agent gathers customer context, detections, indicators of compromise and threat intelligence. A planning model then builds an investigation plan, executes steps and prepares a summary with recommended response actions for analyst review. Other agents can carry out parts of the response when the customer’s service setting allows it.

That boundary matters. Sophos offers customers three MDR modes: Notify, Collaborate and Authorise. In the first, Sophos investigates and recommends action while the customer acts. In the second, Sophos and the customer coordinate before action. In the third, Sophos can respond directly for the customer. OpenAI says those same authority limits apply whether the work is done by a person or by an agent.

Why Security Teams Should Care

The practical value is speed in the part of incident response that often eats time: collecting evidence, matching it to threat intelligence and preparing a defensible next step. A drop from 38 minutes to 89 seconds, if it holds across normal production traffic, changes how many alerts a security team can triage before attackers move deeper into a network.

The tradeoff is that faster investigation is not the same as automatic trust. Sophos is presenting the system as automation inside a controlled MDR service, not as a general promise that any company can hand destructive response actions to an agent. CyberOGZ’s read is that the useful benchmark is not the 96% figure alone. The more important design rule is keeping agent authority aligned with preapproved customer response modes, with human judgment reserved for actions that could create damage.

Security leaders evaluating similar tools should ask vendors for the measurement window, case mix, escalation rules and evidence package behind each automated decision. The headline number is impressive, but the durable lesson is operational: agentic security works best when speed is paired with explicit limits on what the system can do.