Sophos Cuts Threat Investigation Time by 96% Using OpenAI Daybreak
Sophos reports that integrating OpenAI’s Daybreak model has drastically reduced investigation times and automated over half of its managed detection cases.
Key points
- Sophos reduced cyber-threat investigation time by 96% using OpenAI’s Daybreak.
- The integration automated 52% of Managed Detection and Response (MDR) cases.
- Human oversight remains a core component of the automated workflow.
Sophos has significantly accelerated its cyber-threat investigation processes by integrating OpenAI’s Daybreak large language model, according to first-hand research published by OpenAI. The security vendor reports that this integration has cut the time required for threat investigations by 96%.
The deployment of Daybreak within Sophos’s operations has also led to the automation of 52% of its Managed Detection and Response (MDR) cases. Despite the high level of automation, Sophos emphasizes that human oversight is preserved throughout the process, ensuring that analysts retain control over critical security decisions.
Operational Context
The integration marks a notable shift in how security operations centers handle high-volume alert streams. By leveraging Daybreak, Sophos aims to streamline the initial phases of threat analysis, which traditionally consume significant analyst time. The 96% reduction in investigation time suggests that the AI model is effectively handling routine data gathering and preliminary assessment tasks, allowing human experts to focus on complex, high-priority incidents.
According to the research published by OpenAI, the automation of 52% of MDR cases indicates that nearly half of all managed detection events are now resolved or triaged without direct human intervention at every step. This efficiency gain is critical for MDR providers who must balance rapid response times with limited staffing resources. The preservation of human oversight ensures that the automation serves as an augmentation tool rather than a replacement for skilled security professionals.
Impact on Security Operations
This development highlights the growing role of generative AI in cybersecurity operations. For MDR providers, the ability to reduce investigation time by nearly 96% can translate to faster containment of threats and improved service levels for clients. The fact that more than half of cases are automated suggests that Daybreak is capable of handling a substantial portion of common threat patterns and noise that typically bog down security teams.
However, the reliance on AI for such a large percentage of cases also underscores the importance of the human-in-the-loop model. Sophos’s approach ensures that while AI handles the volume, human expertise addresses the nuance and strategic decision-making required in sophisticated attacks. This balance is likely to be a key consideration for other security vendors evaluating similar AI integrations.
What should you do?
Security professionals should monitor how AI integration impacts their own investigation workflows and consider where automation could reduce manual toil without compromising oversight. Organizations adopting AI tools for MDR should establish clear guidelines for when human intervention is mandatory versus when automated responses are sufficient. It is also important to regularly audit AI-driven decisions to ensure accuracy and prevent reliance on flawed models. Finally, teams should train analysts to interpret AI-generated insights rather than simply accepting them, maintaining the necessary critical thinking skills for complex threat analysis.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Sophos
- Audit current MDR workflows to identify repetitive tasks suitable for AI automation while ensuring human oversight remains intact.
- Establish clear escalation paths for AI-handled cases to guarantee that complex or ambiguous threats are reviewed by human analysts.
- Monitor the accuracy and performance of AI tools regularly to ensure they are not introducing errors or missing critical context in threat investigations.
- Train security teams to effectively interpret and validate AI-generated insights, maintaining their ability to make independent strategic decisions.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much did Sophos reduce threat investigation time with OpenAI Daybreak?
Sophos reduced cyber-threat investigation time by 96% by integrating OpenAI’s Daybreak model.
What percentage of MDR cases are now automated?
The integration has automated 52% of Sophos’s Managed Detection and Response cases.
Does the automation remove human oversight from the process?
No, Sophos states that human oversight is preserved while automating 52% of MDR cases.
