Sophos in Practice: How AI Agents Compressed Cybersecurity Response Time from 38 Minutes to 89 Seconds

In cybersecurity, the race against time between attackers and defenders is being fundamentally redefined by frontier AI models. Sophos CTO Jon Peterson (JP) delivered a detailed breakdown at an event for EMEA security leaders, revealing how the global security vendor leveraged OpenAI's Daybreak project to compress average security incident response time from 38 minutes down to 89 seconds — a number that reflects an entire philosophy of human-machine collaboration in security operations.

The "Defender's Window" Is Rapidly Narrowing

Sophos serves approximately 650,000 customers across virtually every industry and scale, giving it visibility into an extraordinarily diverse range of attack patterns and four decades of frontline security experience. JP used the term "defender's window" to frame the central challenge today.

He explained that frontier model capabilities are accelerating rapidly, and increasingly sophisticated cyberattack capabilities are emerging not only in leading closed-source models but also gradually permeating open weight models. The result is faster exploit paths, and the number of CVEs (publicly disclosed security vulnerabilities) has surged dramatically over recent years. As a large security company, Sophos is itself a target — while simultaneously being responsible for protecting 650,000 customers.

JP's logic is clear: if attackers are leveraging frontier intelligence to accelerate their offensives, defenders must reclaim the initiative with the same capabilities. Projects like Daybreak are precisely what allow Sophos to "stay one step ahead of the attacker community."

A Three-Party Collaboration Model: Domain Expertise + Frontier Intelligence + Customers

When discussing the respective roles of OpenAI, Sophos, and customers within this system, JP offered a clear division of responsibilities.

Sophos contributes domain expertise — including threat intelligence, incident response playbooks, and the hard-won operational judgment accumulated by frontline security professionals over many years. Companies like OpenAI provide frontier intelligence, enabling these highly labor-intensive capabilities to be scaled and replicated. Customers are the end beneficiaries this entire system serves and protects.

"Sophos brings the know-how for fighting attacks, and Daybreak and OpenAI bring frontier intelligence that lets us extend our domain expertise to all our customers," JP emphasized. This combination is precisely where the partnership delivers value.

The Fusion System and Agents: From 38 Minutes to 89 Seconds

Understanding the transformation agents bring requires first understanding Sophos's Fusion system — the underlying engine powering Sophos's Managed Detection and Response (MDR) service and its EDR/XDR products.

Fusion integrates sensor data from over 500 third-party security products alongside Sophos's own, generating trillions of events per day. The system distills this massive signal volume into roughly 1,000 to 2,000 cases per day for investigation, handled by analysts across nine Security Operations Centers (SOCs) around the world.

JP presented a striking set of comparative numbers: before agents were introduced, relying on human expertise and established processes, Sophos's average investigation response time was approximately 38 minutes — a result that, 18 months ago, already outperformed 96% of professional security operations centers. Today, with agents built on the Daybreak model, cases handled by agents average approximately 89 seconds, and roughly half of all cases are now handled automatically by agents.

How the Investigation Agent Works

At the execution level, when a case enters the SOC, it is primarily handled by an "investigation agent." The agent aggregates all available case information — customer context, detection results, indicators of compromise (IoCs), and awareness of the threat landscape — and feeds these inputs into a planning model.

That model then enters a "plan–execute–review" loop: generating an investigation plan, executing investigation steps, producing a summary for analysts, and recommending a set of response actions. Sophos has also built agents to handle a portion of those response actions. JP described this mechanism as "transformative" — not only because it accelerates response, but because it delivers more consistent outcomes for customers.

---

MDR (Managed Detection and Response) is a service model where organizations outsource security operations to a third-party security vendor. Rather than building an in-house 24/7 SOC team, businesses rely on the vendor's security analysts to remotely monitor their environments, investigate alerts, and coordinate responses. MDR emerged against the backdrop of a severe global cybersecurity talent shortage — estimated at over 3 million unfilled positions worldwide. EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) are the technology product layers underpinning MDR: EDR focuses on behavioral monitoring and threat detection at endpoint devices, while XDR extends this across endpoints, networks, cloud environments, email, and other data domains to provide analysts with a more complete view of the attack chain. Sophos's Fusion system is the engineering realization of the XDR concept, unifying cross-source signals so that agents have richer investigative context.

---

Where the Saved Time Goes: Addressing the Security Talent Shortage

With response times cut dramatically, where does the freed-up human capacity go? JP brought the conversation back to the industry's most acute pain point — the chronic cybersecurity talent shortage.

He noted that MDR as a business succeeds precisely because security operations analysts with the expertise needed to protect customers are extremely difficult to hire, and building an in-house 24/7 SOC capability is equally challenging for most organizations. The value of agents lies in enabling existing talent to be utilized more efficiently — using scalable compute, rather than difficult-to-scale human capacity, to support the growing workload of the MDR business. For security leaders in the room who broadly feel the skills gap, this point resonated particularly strongly.

Finding Threats Is Just the Beginning — How You Respond Is Where Trust and Judgment Are Tested

Detecting a threat is one thing; deciding how to respond involves trust and judgment — and this is where Sophos has been most deliberate in its automation design. JP walked through three operational modes Sophos established from the outset:

• Notify: The SOC conducts a complete investigation but never takes response action independently — it only provides guidance and recommendations to the customer.
• Collaborate: A complete investigation is conducted, but any response requires direct customer involvement.
• Authorize: Sophos is granted full authorization to take response actions directly on the customer's behalf.

The design intent of these modes is to "meet the customer where they are" — aligning the service model to each customer's own level of expertise and trust. Critically, the same principle applies equally to human analysts and to agents.

JP was particularly emphatic that any response action with potentially destructive consequences must be deferred to human judgment. Agents have automated a substantial portion of the investigation work, but significant human involvement is retained in the response phase. Looking ahead, he expects response capabilities to mature and cover more use cases — but at least for now, "any operation that could cause disruption in a customer's environment will have human oversight." The core mission remains constant: keep customers protected, maintain business continuity, and return control to the customer.

---

Sophos's three-tier authorization model is representative of a broader industry pattern — essentially a layered implementation of the "Human-in-the-Loop" principle. In automated decision systems, "human-in-the-loop" refers to retaining human approval or oversight at critical decision points to prevent irreversible consequences from system errors. In cybersecurity response, the cost of a mistaken action can be extremely high — for example, automatically isolating a critical business server could cause an outage comparable in impact to the attack itself. Under the Authorize mode, customers effectively sign a blanket pre-authorization, delegating real-time decision-making authority fully to Sophos; the Notify mode, by contrast, retains all judgment on the customer side. This design also reflects a universal challenge in deploying AI agents in enterprise settings: the tension between automation efficiency and the delegation of control, which must be managed through a combination of contractual, procedural, and technical mechanisms.

---

Don't Lose the Fundamentals: In the Age of AI Acceleration, Basic Security Hygiene Matters More Than Ever

When asked what the "first step" should be for security leaders, JP's answer was surprisingly straightforward: get the fundamentals right.

In an environment where the defender's window is narrowing, frontier intelligence is accelerating, and even relatively unskilled attackers can cause real damage, solid fundamentals matter more than ever. His checklist: a patch management program for CVEs, best-in-class endpoint protection, multi-factor authentication (MFA) covering all identity infrastructure, strong network segmentation, and robust security operations programs wrapping all of it together.

"None of what I'm saying is novel," JP acknowledged, "but we can get distracted by the rapid pace of technological change. We absolutely want to use agents to help security teams manage the growing workload — but basics like endpoint protection are more important today than they've ever been." This may be the single most important line from the entire conversation for security practitioners to sit with.

Background Notes

Open Weight Models refer to AI models whose weight parameters are publicly released and available for anyone to download and run locally — such as Meta's LLaMA series. Unlike fully closed commercial API models, open weight models can run in offline, unaudited environments. Attackers can fine-tune them or remove safety guardrails ("jailbreak" them) to generate phishing content, exploit code, or social engineering scripts at low cost. This is the core reason JP emphasized the danger of "attack capabilities permeating open weight models": advanced attack capabilities no longer reside exclusively in closed-source APIs gated by access controls — they are gradually becoming universally accessible infrastructure, dramatically lowering the barrier for low-to-mid-skill attackers to launch sophisticated campaigns.