Sophos cuts threat investigation time by 96% with OpenAI Daybreak

OpenAI has published a customer story describing how the security vendor Sophos uses its Daybreak offering to speed up cyber-threat investigation. According to OpenAI, the setup cut Sophos's threat investigation time by 96%.

The company says Sophos also automated 52% of its MDR, or managed detection and response, cases. MDR work typically involves analysts manually triaging a steady stream of alerts, so automating more than half of those cases represents a substantial shift in day-to-day security operations.

OpenAI stresses that human oversight is preserved. In other words, the system raises the level of automation while analysts still review and make the calls, rather than handing decisions entirely to a model.

Daybreak acts here as an accelerator for investigation and analysis. Faced with large volumes of security alerts, it helps surface and interpret evidence faster, easing the load on stretched security teams.

Security operations is one of the areas where agentic AI is showing early value. The work is high-volume, repetitive, and time-sensitive, which is exactly the profile that makes AI-assisted triage useful.

It is worth noting that these figures come from a customer story published by OpenAI, so they reflect the vendor's framing. How reproducible the results are will depend on the specific environment and how the deployment is set up.

The question to watch is how offerings like this are packaged and made available, and where the line between automation and human review settles in real production environments.