Sophos
A global cybersecurity vendor offering security products and services including Managed Detection and Response (MDR), Endpoint Detection and Response (EDR), and Extended Detection and Response (XDR), with more than 40 years of operational security experience.
Timeline (last 90 days)
Sophos achieved automated processing in 52% of its MDR cases while retaining human oversight.
Sophos's agent feeds customer context, threat posture, detection results, and Indicators of Compromise (IOCs) into OpenAI's planning model, forming a plan-execute-observe loop
Approximately two years ago to 18 months ago, the Sophos MDR team's average response time was around 38 minutes
OpenAI's Daybreak project provides Sophos with the opportunity to invoke frontier intelligence for identifying product vulnerabilities and designing guardrails for agents with looser constraints
Sophos adopts a division of labor in which domain experts provide knowledge and frontier models provide scale, embedding agents into existing operational workflows rather than replacing security experts
One of Sophos's core businesses is Managed Detection and Response (MDR), taking on security operations on behalf of customers
While advancing automation, Sophos explicitly emphasized the retention of human oversight.
Sophos achieved 52% automation of Managed Detection and Response (MDR) cases.
Sophos reduced cyberthreat investigation time by 96% by deploying OpenAI's Daybreak technology.
Sophos has defined three operating modes: Notify (notification only, providing recommendations without taking response action), Collaborate (collaboration, where response requires direct customer involvement), and Authorize (authorization, where Sophos can respond directly on behalf of the customer)
10 more timeline events
All Facts (20)
Sophos achieved automated processing in 52% of its MDR cases while retaining human oversight.
50%UnverifiedSophos's agent feeds customer context, threat posture, detection results, and Indicators of Compromise (IOCs) into OpenAI's planning model, forming a plan-execute-observe loop
50%UnverifiedApproximately two years ago to 18 months ago, the Sophos MDR team's average response time was around 38 minutes
50%UnverifiedOpenAI's Daybreak project provides Sophos with the opportunity to invoke frontier intelligence for identifying product vulnerabilities and designing guardrails for agents with looser constraints
50%UnverifiedSophos adopts a division of labor in which domain experts provide knowledge and frontier models provide scale, embedding agents into existing operational workflows rather than replacing security experts
50%UnverifiedOne of Sophos's core businesses is Managed Detection and Response (MDR), taking on security operations on behalf of customers
50%UnverifiedWhile advancing automation, Sophos explicitly emphasized the retention of human oversight.
50%UnverifiedSophos achieved 52% automation of Managed Detection and Response (MDR) cases.
50%UnverifiedSophos reduced cyberthreat investigation time by 96% by deploying OpenAI's Daybreak technology.
50%UnverifiedSophos has defined three operating modes: Notify (notification only, providing recommendations without taking response action), Collaborate (collaboration, where response requires direct customer involvement), and Authorize (authorization, where Sophos can respond directly on behalf of the customer)
50%UnverifiedSophos, leveraging OpenAI's Daybreak project, compressed the average security incident response time from 38 minutes to approximately 89 seconds
50%UnverifiedAny response action that could cause disruptive consequences must be subject to human judgment and oversight
50%UnverifiedSophos serves approximately 650,000 customers, spanning nearly all industries and size segments
50%UnverifiedJon Peterson is the Chief Technology Officer of Sophos
50%UnverifiedFusion is the underlying engine powering Sophos's Managed Detection and Response (MDR) service as well as its EDR/XDR products
50%UnverifiedFusion integrates sensor data from more than 500 third-party security products and Sophos's own products, generating trillions of events per day
50%UnverifiedThe Fusion system distills massive volumes of signals into approximately 1,000 to 2,000 cases per day for investigation, handled by 9 Security Operations Centers (SOCs) worldwide
50%UnverifiedPrior to the introduction of the Agent, Sophos's average investigation response time was approximately 38 minutes, a performance that outperformed 96% of professional security operations centers 18 months ago
50%UnverifiedCurrently, approximately half of cases are handled automatically by the Agent
50%UnverifiedThe investigation Agent aggregates customer context, detection results, Indicators of Compromise (IoCs), and other information for a case, feeds it to a planning model, enters a 'plan–execute–review' loop, generates an investigation plan, and provides recommended response actions
50%