Sophos reports 96% faster threat response with AI

Sophos says AI agents built through OpenAI Daybreak have cut the average response time for cases using those agents from about 38 minutes to 89 seconds. According to OpenAI’s account of the rollout, Sophos now resolves 52% of its managed detection and response (MDR) cases end to end with AI, within boundaries set by its analysts.

The agents gather details about a case, draw up and carry out an investigation plan, then summarise what they found and recommend response actions for analysts to review. Other agents can carry out parts of the response. Sophos says its systems draw on its own products and more than 500 third-party integrations. These are results from Sophos’s service, not a promise that every security provider or customer will see the same speed.

Faster investigations still need clear authority

If you run a business of five to fifty people, the useful question is what happens when your security provider spots a threat. Can it investigate quickly, explain its findings and tell you what action it recommends? Sophos’s example shows how AI can help with that work. It also shows why speed alone is an incomplete measure: someone still needs to decide which actions a provider may take for you.

In OpenAI’s description, Sophos gives MDR customers three operating modes. Under Notify, Sophos investigates and recommends a response, while the customer acts. Under Collaborate, they work together before action is taken. Under Authorise, Sophos can respond on the customer’s behalf. Sophos says those boundaries apply whether a person or an agent does the work, and that it passes decisions requiring human judgement to a person.

That distinction matters when you review your own arrangement. A fast investigation may give you information sooner, but the response could still depend on your approval. Conversely, giving a provider authority to act may mean decisions are made before you speak to them. Ask for a plain explanation of the arrangement you have chosen and how it works outside business hours.

Ask your provider what AI does and who approves the response

Start with a specific question: does your provider use AI to investigate alerts, and if so, which parts of the investigation does it complete? Ask what a person checks, how the provider records its findings and whether it can show you a clear summary of an incident. Sophos says its agents produce summaries and recommended actions for analysts to review; use that as a practical prompt for the conversation, not as a benchmark every provider must match.

Then ask which response actions the provider can take immediately, which require your approval and who at your business can give it. Get those answers in writing so the person handling an alert knows the agreed boundary. If you want the provider to act on your behalf, ask how it handles actions that could disrupt your work. OpenAI says Sophos retains human oversight for potentially destructive actions.

Finally, keep the basic protections in view. Sophos’s chief technology officer recommends patching, endpoint protection, multifactor authentication, network segmentation and strong security operations as parts of a layered approach. AI may shorten an investigation, but your next step is simpler: confirm what your provider will investigate, what it may do, and when it must ask you first.