Sophos says its AI agents cut incident response to 89 seconds, according to its own report with OpenAI

By Zendoric · October 9, 2026.

Sophos says its artificial intelligence agents, built on OpenAI's Daybreak program, have cut the average response time to a cybersecurity incident from about 38 minutes to 89 seconds. According to the customer story published by OpenAI on October 9, half of managed detection and response cases (MDR, the service in which a provider monitors the client's network and responds to threats on its behalf) are already resolved end to end by AI, within the limits calibrated by Sophos analysts.

The deployment rests on Sophos Fusion, the company's defense system, which integrates more than 500 third-party data sources alongside its own products. Those sensors generate, according to Sophos itself, trillions of events a day, which the company narrows down to between 1,000 and 2,000 cases investigated by its nine security operations centers (SOCs). Sophos protects more than 625,000 organizations and more than 40,000 MDR customers worldwide, figures that convey the scale of the problem an agent has to help sort out.

The workflow, as described by OpenAI, splits the case among several agents: one gathers the customer context, the detections and the indicators of compromise; a planning model runs a plan, execute and review loop until it produces a summary with recommended actions; and other agents can handle parts of the response. John Peterson, Sophos's chief technology officer, framed the goal not as giving analysts "another tool," but as scaling to every customer an experience built over more than four decades of confronting attacks.

Human control is maintained through three operating modes: in "Notify," Sophos investigates and recommends but the customer acts; in "Collaborate," Sophos and the customer decide together; in "Authorize," Sophos responds directly on the customer's behalf. Peterson was explicit that potentially destructive actions still require human oversight, regardless of whether the prior work was done by a person or an agent: "Anything we are not comfortable having an agent handle is deferred to human judgment," he told OpenAI.

The piece fits into Daybreak, the program through which OpenAI bundles frontier models, its Codex code execution environment, security tools and supervised workflows for "verified defenders" to use with reinforced scoping controls. OpenAI has committed $1 billion in subsidized access to Daybreak over six months for state and local governments, critical infrastructure operators, community banks, nonprofits and open source project maintainers. Sophos joined the program on June 22, 2026 and, on August 10, extended the agreement to its channel of more than 25,000 partners and 7,000 managed service providers.

These figures should be read through the right filter: they are not an independent audit, they are a customer case study OpenAI publishes to sell its own product, with statements from the company that bought it. Peterson himself places the starting point already very high —he says Sophos's manual process, at 38 minutes, beat "96% of professional security operations centers"—, which makes the jump to 89 seconds more striking but also a reminder that the basis for comparison is chosen by whoever tells the story. Our line on this terrain is consistent: separate demonstrated capability from the marketing narrative, and here we have both mixed into the same source.

That said, the underlying figure —52% of MDR cases resolved end to end by AI, repeated identically back in June and now in October— points to something real and more interesting than the 89-second headline: cybersecurity is one of the sectors with a chronic talent shortage, and here AI is not sold as a substitute for analysts but as a way to scale compute instead of depending on headcount growth the market cannot supply. It is the same logic we already saw in banking and insurance or in business administration: expert judgment does not disappear, it concentrates on the exceptions where it is worth most, while routine volume is automated. The three-tier control model —notify, collaborate, authorize— is also a reasonable governance template that other sectors using agentic AI should look at: speed is not at odds with leaving irreversible decisions in human hands.

And there is a broader read that connects with an angle we have already covered: the same agentic AI that industrializes fraud and espionage on the offensive side is the one deployed here on the defensive side, compressing a response from minutes to seconds. If it really manages to encode four decades of experience against attacks and put it within reach of 625,000 organizations —and not just those that can afford their own SOC—, that points in the direction of our underlying thesis: AI as a force that democratizes capabilities once reserved for a few. The scarce talent problem in cybersecurity is not solved by customer stories, but it is exactly the kind of bottleneck that an abundance of compute, well governed, is in a position to ease.