From 38 Minutes to 89 Seconds: How Sophos Used OpenAI Daybreak to Compress Cyber Threat Response

In cybersecurity, the difference between 38 minutes and 89 seconds is not just a performance improvement - it's a different threat model entirely. That's the gap Sophos says it has closed by deploying AI agents built through OpenAI's Daybreak program, reducing threat investigation time by 96% and automating the resolution of more than half of its managed detection and response (MDR) cases end-to-end. 1

The results, published by OpenAI on October 9, 2026, represent one of the clearest production-scale demonstrations of what agentic AI can do when it's given domain-specific intelligence, curated tools, and relaxed guardrails inside a controlled professional setting.

What Daybreak Actually Is

OpenAI launched Daybreak in May 2026 as a cybersecurity initiative pairing frontier AI models with agentic security workflows and a vetted partner ecosystem. 2 The program gives approved security organizations access to models with significantly fewer content restrictions than standard commercial offerings - because, as OpenAI acknowledges, most real defensive security work would otherwise trip standard safety filters. 3

By August 2026, OpenAI had expanded Daybreak into two distinct tiers: Daybreak Blue for everyday defensive workflows such as malware analysis, secure code review, and vulnerability triage, and Daybreak Red for advanced authorized vulnerability research. 4 The expansion also shipped GPT-5.6-Cyber, a model that in internal evaluations handled 95% of advanced cybersecurity task prompts - covering scenarios including exploit-chain development, authentication bypass, and privilege escalation - compared to just 1.5% for the same model with default protections. 5

Then, in September 2026, OpenAI announced Daybreak for Frontline Defenders, a $1 billion commitment in subsidized access to its cyber AI tools, training, and support for resource-constrained organizations - water utilities, electric grid operators, local governments, and community banks. 6

Sophos joined the Daybreak Defense Network (formerly the Daybreak Cyber Partner Program) in June 2026 7 and has now gone public with the production results.

Inside the Sophos Deployment

Sophos protects more than 625,000 organizations globally. 8 Its AI-native cyber defense platform, Sophos Fusion, aggregates data from more than 500 third-party integrations alongside Sophos's own products. 9 Those sensors generate trillions of events daily, which Sophos distills into roughly 1,000 - 2,000 cases per day for its nine security operations centers to investigate. 10

Before Daybreak, that investigation process was primarily human-driven. The Daybreak agents now change how those cases are handled through a multi-step agentic pipeline:

1. An investigation agent gathers customer context, security alerts, indicators of compromise (IoCs), and threat intelligence to build a structured picture of what may be happening. 11
2. The agent plans and executes parts of the investigation, combining OpenAI's frontier models with Sophos's own threat intelligence and response playbooks. 12
3. For cases where AI reaches a confident conclusion within human-defined boundaries, the case is resolved end-to-end without requiring analyst intervention.

The outcome: average response time for agent-handled cases has dropped from approximately 38 minutes to 89 seconds. 13 Sophos now reports that 52% of its MDR cases are resolved end-to-end by AI. 14

Sophos CTO John Peterson has noted that Daybreak allowed the company to build agents with less restrictive guardrails than standard commercial models - crucial because "most of Sophos's work is in areas that would trip guardrails." 15

Two Different Metrics Worth Understanding

It's worth being precise about what the numbers mean. Sophos is reporting two distinct improvements:

• Speed: For cases using the agents, average response time has gone from ~38 minutes to 89 seconds - a 96% reduction.
• Coverage: 52% of all MDR cases are now resolved end-to-end by AI within analyst-defined boundaries.

These measure different things: the first captures speed on agent-assisted work; the second captures how much total casework is automated. Together they tell a coherent story - more than half the case volume is handled fully autonomously, and for those cases, the speed improvement is dramatic. Human analysts retain oversight and set the boundaries within which the agents operate. 16

Why It Matters

The Sophos result is significant for several reasons beyond the headline numbers.

It's a production benchmark, not a lab result. The 96% figure comes from a live SOC environment processing real enterprise threat data at scale, not a controlled red-team exercise or benchmark dataset.

It illustrates the guardrail tradeoff. Standard commercial LLMs are too restricted for most professional security work. Daybreak's value proposition is precisely that it offers calibrated relaxation of those restrictions to vetted defenders - a model for how AI capability and safety can co-exist in specialized professional contexts rather than treating them as a binary choice.

It frames the defender's time problem. As AI accelerates attacker timelines, the window in which defenders can detect and respond to threats shrinks. Getting investigation time from 38 minutes to under 90 seconds is not incremental - it changes whether a defender can act before an attacker completes their objective.

It sets a template for agentic specialization. Sophos didn't deploy a general-purpose AI assistant - it built a pipeline of purpose-built agents grounded in proprietary threat intelligence and response playbooks. That specificity is almost certainly a major reason the results are this strong.

As OpenAI continues to build out Daybreak as an ecosystem - now including partners such as Cisco, CrowdStrike, Cloudflare, Palo Alto Networks, Accenture, and IBM 17 - the Sophos deployment provides the field with a credible, detailed reference point for what agentic AI in security operations actually looks like when it works.