Sophos to use OpenAI's GPT models to verify which vulnerabilities are actually exploitable

Sophos has announced Exploit Path Verification (EPV), a new capability in development for its Sophos Managed Risk service that aims to solve one of the most persistent problems in vulnerability management: knowing which of the flaws detected in an environment are genuinely exploitable by an attacker, rather than relying on generic severity scores. To that end, the company will integrate OpenAI's cybersecurity-specialized GPT models through the OpenAI Daybreak Defense Network, a network Sophos joined in June 2026.

The planned approach combines the OpenAI model's reasoning with operational data supplied by Sophos: asset and patch status, endpoint protection policies, the vulnerability's reachability within the network, identity and privilege information, and the availability of known exploits for that specific flaw. With all of that, EPV will classify each finding into one of four categories: Confirmed exploitable, Blocked by an existing control, Not reachable, or Insufficient evidence. Sophos has stressed that every verdict will be accompanied by the evidence supporting it and will be reviewed by its own security analysts, a relevant nuance indicating that the system will not operate fully autonomously, but with a human in the loop.

Beyond assessing vulnerabilities in isolation, the capability is also designed to detect attack chains: situations in which several individually low-severity vulnerabilities can be combined to open a significant path to compromise, something that traditional scanning approaches, focused on per-flaw scores, tend to miss. EPV will also include remediation recommendations, guiding security teams on what to fix first.

John Peterson, Sophos's chief technology officer, framed the project's goal in terms of noise reduction and evidence-based prioritization: the idea is to make clear which part of the environment is actually reachable by an attacker, with proof to back it up, so teams fix what truly matters first. For OpenAI, McCall McIntyre, head of global cyber partnerships, described the collaboration as an example of applying frontier reasoning to a real defensive problem, with the safeguards that responsible deployment demands, and positioned the purpose of the Daybreak Defense Network as giving defenders the advantage of frontier AI safely.

This initiative fits into a broader trend in the cybersecurity sector toward so-called exploitability-based prioritization, which seeks to replace or complement static severity scores with contextual assessments of the real risk in each specific environment. Alert fatigue and the practical impossibility of patching every detected vulnerability have pushed risk management vendors to bring in more context —control configuration, network exposure, exploit availability— before deciding what to remediate first. What is new here is the explicit use of OpenAI reasoning models as the analytical engine within that process, instead of heuristics or more traditional machine learning models, and the fact that OpenAI itself is presenting as a partner in a network designed specifically for defensive cybersecurity use cases.

For now, Sophos has indicated that EPV is in development and aimed at enterprise and mid-market customers of Sophos Managed Risk, with no dates or terms for general availability or early access yet specified, details the company has said it will announce later. That places the announcement at an early stage: this is a capability under construction rather than an already deployed product, so its real-world effectiveness —false positive or negative rates in exploitability classification, the quality of the attack chains detected, or the actual degree of analyst oversight maintained once it scales— remains to be seen when the first access programs and effective deployments arrive.