Sophos says its AI agents cut incident response to 89 seconds, according to its own report with OpenAI

By Zendoric · October 9, 2026.

Sophos says its artificial intelligence agents, built on OpenAI's Daybreak program, have cut the average response time to a cybersecurity incident from about 38 minutes to 89 seconds. According to the customer story published by OpenAI on October 9, half of all managed detection and response cases (MDR, the service in which a provider monitors the client's network and responds to threats on its behalf) are now resolved end to end by AI, within the limits calibrated by Sophos analysts.

The deployment rests on Sophos Fusion, the company's defense system that integrates more than 500 third-party data sources alongside its own products. Those sensors generate, according to Sophos itself, trillions of events a day, which the company narrows down to between 1,000 and 2,000 cases investigated by its nine security operations centers (SOCs). Sophos protects more than 625,000 organizations and more than 40,000 MDR customers worldwide, figures that give a sense of the scale of the problem an agent has to help sort out.

The workflow, as described by OpenAI, splits the case across several agents: one gathers customer context, detections and indicators of compromise; a planning model runs a plan-execute-review loop until it produces a summary with recommended actions; and other agents can handle parts of the response. John Peterson, chief technology officer at Sophos, framed the goal not as giving analysts "another tool," but as scaling to every customer an expertise built over more than four decades of facing attacks.

Human control is maintained through three operating modes: in "Notify," Sophos investigates and recommends but the customer acts; in "Collaborate," Sophos and the customer decide together; in "Authorize," Sophos responds directly on its behalf. Peterson was explicit that potentially destructive actions still require human oversight, regardless of whether the prior work was done by a person or an agent: "Anything we're not comfortable having an agent handle is deferred to human judgment," he told OpenAI.

The piece fits into Daybreak, the program through which OpenAI packages frontier models, its Codex code execution environment, security tools and supervised workflows for "verified defenders" to use with reinforced scope controls. OpenAI has committed $1 billion in subsidized access to Daybreak over six months for state and local governments, critical infrastructure operators, community banks, nonprofits and open source project maintainers. Sophos joined the program on June 22, 2026 and, on August 10, extended the agreement to its channel of more than 25,000 partners and 7,000 managed service providers.

These figures should be read with the right filter: they are not an independent audit, they are a customer case that OpenAI publishes to sell its own product, with statements from the company that bought it. Peterson himself places the starting point very high — he says Sophos's manual process, at 38 minutes, beat "96% of professional security operations centers" — which makes the jump to 89 seconds more striking, but also a reminder that the benchmark is chosen by whoever tells the story. Our line on this terrain is consistent: separate demonstrated capability from the marketing narrative, and here we have both mixed into the same source.

That said, the underlying figure — 52% of MDR cases resolved end to end by AI, repeated identically back in June and now in October — points to something real and more interesting than the 89-second headline: cybersecurity is one of the sectors with a chronic talent shortage, and here AI is not being sold as a replacement for analysts but as a way to scale compute instead of depending on headcount growth the market cannot supply. It is the same logic we already saw in banking and insurance, or in business administration: expert judgment does not disappear, it concentrates on the exceptions where it is worth most, while routine volume is automated. The three-tier control model — notify, collaborate, authorize — is also a sensible governance template that other sectors with agentic AI should look at: speed is not at odds with leaving irreversible decisions in human hands.

And there is a broader reading that connects with an angle we have already covered: the same agentic AI that industrializes fraud and espionage on the offensive side is the one deployed here on the defensive side, compressing a response from minutes to seconds. If it really manages to encode four decades of experience against attacks and make it available to 625,000 organizations — and not just to those that can afford their own SOC — that points in the direction of our underlying thesis: AI as a force that democratizes capabilities once reserved for a few. The scarce talent problem in cybersecurity will not be solved by customer stories, but it is exactly the kind of bottleneck that an abundance of compute, well governed, is in a position to ease.