Sophos says agents built with OpenAI Daybreak reduced average response time to 89 seconds for cases using them and resolved 52% of MDR cases end-to-end.
Sophos says AI agents developed through OpenAI’s Daybreak program have shortened its handling of some managed detection and response (MDR) cases. In a case study published October 9, 2026, OpenAI reported Sophos figures showing average response time for cases using the agents fell from about 38 minutes to 89 seconds, while AI resolved 52% of MDR cases end-to-end.
Sophos built the agents into Sophos Fusion, its cyber defense system. The system draws on sensor data from more than 500 third-party integrations as well as Sophos products. Those sources produce trillions of events each day, which the company narrows to roughly 1,000 to 2,000 cases for investigation across nine security operations centers.
For each case, an investigation agent gathers customer context, detections, indicators of compromise and relevant threat intelligence. A planning model then lays out and carries out investigative steps, before producing a summary and recommended response actions for analysts. Other agents can perform parts of the response process.
The reported automation does not remove customer controls or human review. Sophos offers three service modes: Notify, where it recommends action for the customer to take; Collaborate, where Sophos and the customer decide together; and Authorise, where Sophos can act on the customer’s behalf. The company says potentially destructive responses remain subject to the appropriate oversight, and cases agents are not suited to handle go to human judgment.
Sophos CTO John Peterson said the earlier process averaged around 38 minutes and that the 89-second figure applies to cases handled using agents. OpenAI’s account says Sophos intends to expand the agents’ capabilities and range of use cases. The results are company-reported and describe Sophos’s deployment; they do not establish equivalent performance for other security operations teams.