Frontier AI is changing cybersecurity on both sides, according to the article. Advanced models can help defenders find and investigate threats faster, but those capabilities are also spreading to open-weight models, giving attackers new ways to discover vulnerabilities and accelerate exploitation. Sophos is one company positioned against that trend; it protects more than 625,000 organisations across sectors and regions. “We see a huge variety of different attacks,” says CTO John Peterson, citing four decades of expertise in combating them. Through OpenAI Daybreak, Sophos is combining OpenAI models with its own threat intelligence, response playbooks and security expertise. The stated aim is not simply to give analysts another tool but to increase the impact of Sophos’s expertise across every customer it protects.

At the centre of the rollout is Sophos Fusion, the company’s AI-native cyber defense system that includes Sophos Managed Detection and Response (MDR). Fusion gathers sensor data from more than 500 third-party integrations alongside Sophos’s own products. Together those sensors generate trillions of events each day, which Sophos distills into roughly 1,000 to 2,000 cases for its nine security operations centres to investigate. Agents built through Daybreak have changed how those cases are handled.

An investigation agent collects customer context, detections, indicators of compromise (IoCs) and relevant threat intelligence for each case. A planning model then creates a plan–execute–review loop: building an investigation plan, completing the steps, and producing a summary with recommended response actions for analysts to review. Other agents can carry out parts of the response.

Before Daybreak, investigating and responding to a case depended primarily on human expertise. Sophos’s existing process averaged around 38 minutes — performance Peterson says was better than 96% of professional security operations centres. Now, because of the agents built through Daybreak, the average response time for cases using those agents has fallen to about 89 seconds. Peterson says about half of the cases Sophos handles are now automated by agents developed using the Daybreak models.

Sophos has built customer control into MDR through three operating modes: Notify, where Sophos investigates and recommends a response but the customer acts; Collaborate, where Sophos and the customer work together before action; and Authorise, where Sophos can respond directly on the customer’s behalf. The same boundaries apply whether work is completed by a person or an agent. Sophos uses automation to move quickly and make better use of analysts’ time, but potentially destructive actions still require the right level of human oversight. As Peterson puts it, anything Sophos is not comfortable with an agent handling gets passed off for human judgement.

The reported results include a reduction in average response time for agent-handled cases from about 38 minutes to 89 seconds; 52% of MDR cases resolved end-to-end by AI within boundaries calibrated by Sophos analysts; faster and more consistent investigation experiences for customers; compute scaling rather than equivalent growth in cybersecurity headcount; and analysts returning to threats, exceptions and decisions where their expertise matters most. Peterson says Sophos will keep expanding what its agents can do: response capabilities will become more sophisticated, and the range of use cases will broaden. His advice to other security leaders is to focus on security fundamentals — patching alone only covers vulnerabilities known to vendors, so a layered approach with endpoint protection, MFA, network segmentation and strong security operations is essential. He describes vulnerabilities being discovered at an alarming rate and exploited at a scale never seen before.