EngineeringPublished 6 days ago1 min read

Sophos Reduces Threat Investigation Time by 96% Using OpenAI Daybreak

Sophos uses OpenAI’s Daybreak to automate over half of MDR cases and dramatically reduce cyber-threat investigation time while maintaining human oversight.

A wide dark glass operations panel floating in the center. On it, a long row of dim tick marks and one short segment glowing bright cyan, as

According to OpenAI (2026-10-09), Sophos has integrated OpenAI’s Daybreak system into its Managed Detection and Response (MDR) operations. The impact is significant: threat investigation times have dropped by 96%, and 52% of MDR cases are now automated, all while preserving human oversight and quality assurance.

What’s Changed

Investigation Speed: Threat analysis that previously would take much longer is now resolved in a fraction of the time.
MDR Automation: Over half of MDR workflows are auto-processed by Daybreak’s AI.
Human Review: Automation is combined with expert human review for critical decisions, ensuring sophisticated oversight.

What You Should Do

Consider leveraging AI systems like Daybreak to reduce response times for incidents in your own security or ops workflows.
Monitor which routine cases can be confidently automated, but make sure high-stakes decisions remain under human control.
Prepare your team to collaborate with AI decision-support—clear escalation paths and QA steps are key.

Takeaway

Daybreak has allowed Sophos to scale its MDR effectiveness without sacrificing quality, showing how AI can maximize both efficiency and trust in operational security environments.