Sophos Cuts Cyberthreat Investigation Time by 96% with OpenAI Daybreak

Sophos says it has cut cyberthreat investigation time by 96% and automated 52% of cases in its MDR (managed detection and response) service using OpenAI Daybreak. Taken literally, an investigation now takes 4% of the time it used to, roughly 25 times less. Human oversight remains in place: analysts stay in the decision-making loop. The data was published on the OpenAI blog on October 9, 2026.

What Exactly Got Faster

MDR is a service in which a vendor's team of analysts triages alerts across a client's infrastructure around the clock. The most costly part of the job is the investigation. Analysts have to collect telemetry from endpoints and the network, correlate events over time, work out whether they are looking at an attack or noise, and decide what to do next. This routine has long been constrained by a shortage of specialists and the sheer volume of alerts. According to the case description, this is where Daybreak delivers its gains.

The second number matters too. With 52% of cases automated, roughly every second MDR case follows a path where the system, not a human, does the main work.

Key Metrics

• Cyberthreat investigation time: −96%.
• Share of automated MDR cases: 52%.
• Operating model: automation with human oversight retained.
• Source: OpenAI blog, Sophos customer story.

What the Publication Leaves Out

This is a customer case study on the technology vendor's own platform, and it should be read accordingly. The available description lacks several details without which the figures are hard to compare with anything.

First, the baseline. It is unclear whether the 96% is calculated against average investigation time, the median, or specific case types. Second, the definition of "automated." It could mean a case closed entirely without a human, or it could mean a prepared analysis that an analyst merely confirms. Third, quality. In security, speed proves little without data on missed threats and false positives. There, the measure is the cost of a mistake, not seconds.

The architecture is not disclosed either: how Daybreak is built into Sophos's workflows and which actions it is allowed to take on its own. These details determine how easily the experience can be replicated.

How to Read Numbers Like These

It is too early to judge from the 96% figure alone. For an MDR provider, the 52% matters more: coverage determines how many cases the system takes on and how analyst workload changes. If automation touches half the flow, the freed-up time can go to complex incidents that need a human.

For anyone choosing an MDR service or evaluating AI for their own SOC, it is worth putting a few specific questions to the vendor:

• What is the time reduction measured against, and on which case types?
• Which steps does the system perform on its own, and which require analyst confirmation?
• How are missed threats and false positives measured before and after deployment?
• Who is accountable for the decision if an automated conclusion turns out to be wrong?

The main point of the Sophos case is that AI is presented as an accelerator for analysts, not a replacement. In an industry where mistakes are expensive, that framing looks more realistic than slogans about full autonomy. It will have to be verified through independent measurements, not press releases.