Sophos says AI agents built through the OpenAI Daybreak program have helped automatically resolve 52% of cases in its managed detection and response (MDR) service. Average response time for cases using agents fell from around 38 minutes to 89 seconds. Notably, authority to act remains limited by customer agreements, rather than handing all response activities over to AI by default.
The figures appear in a Sophos case study published by OpenAI on October 9, 2026. These are company-provided results, not an independent assessment of security effectiveness.
AI Investigates, Plans and Proposes Responses
The Sophos Fusion system combines data from Sophos products and more than 500 third-party integrations. According to the publication, this data is filtered into around 1,000–2,000 cases for nine security operations centers to investigate each day.
An investigation agent gathers customer context, detection information, indicators of compromise and relevant threat intelligence. A planning model then runs a loop of planning, execution and review, producing a summary and proposed actions for analysts to review. Other agents can carry out part of the response.
This setup shifts the focus from AI answering questions to handling a workflow with context and checkpoints. A related approach is Cloudflare’s separation of evidence from AI reasoning in security.
Three Customer Modes Determine Authority to Act
Sophos describes three MDR operating modes:
Notify: Sophos investigates and proposes a response; the customer takes action.
Collaborate: Sophos coordinates with the customer before taking action.
Authorise: Sophos is authorized to respond directly on the customer’s behalf.
These boundaries apply to both humans and AI agents. According to CTO John Peterson, work that Sophos is not yet comfortable assigning to agents is passed to humans for judgment. Potentially destructive actions still require an appropriate level of oversight.
Thus, “end-to-end automated handling” does not mean unlimited authority. It takes place within a scope calibrated by Sophos analysts. The issue of separating reasoning capabilities from execution authority is also addressed in Muse’s Sentinel action control layer.
Time Savings Do Not Tell the Full Story on Quality
OpenAI cites a 96% reduction in investigation time, but the 89-second figure is described specifically for cases using agents. It should not be interpreted as the response time for every MDR case or as evidence that every type of attack is handled better.
The publication does not provide a detailed breakdown of error rates or outcomes by severity. Therefore, evaluating AI before deployment still requires considering quality, cost and control together, rather than speed alone.
Sophos says it will expand the agents’ response capabilities and range of tasks. No specific timeline or figures are available for upcoming capabilities. Peterson also emphasizes layered security, including patching, endpoint protection, multifactor authentication and network segmentation; automating investigations does not replace these foundations.