From 38 minutes to 89 seconds per case
On 9 October 2026, OpenAI published a case study describing how Sophos, protecting more than 625,000 organizations, used OpenAI Daybreak to combine frontier models with Sophos threat intelligence, response playbooks and security expertise. Before Daybreak, investigating and responding to a case averaged around 38 minutes. With Daybreak-powered agents, the average response time for cases using those agents fell to about 89 seconds--a 96% reduction.
Sophos CTO John Peterson says the company sees a huge variety of attacks and has cultivated expertise over four decades. Through Daybreak, Sophos built agents that now resolve 52% of MDR (Managed Detection and Response) cases end-to-end, within boundaries calibrated by Sophos analysts. The agents handle investigation and response; human analysts keep judgement at the centre for decisions where expertise matters most.
Daybreak: a programme, not just a model
OpenAI Daybreak is described as a programme that combines OpenAI models with customer threat intelligence, playbooks and expertise. The case study emphasizes that the models alone are not the differentiator--the integration of Sophos-specific context (threat intelligence, response procedures, analyst-calibrated boundaries) is what enables the 52% end-to-end automation rate.
The results highlight a shift: advanced models help defenders investigate faster, but those same capabilities are spreading to open-weight models, giving attackers new ways to discover vulnerabilities and accelerate exploitation. Sophos positions itself as standing in the way.
One customer, calibrated boundaries, MDR scope
The 96% and 52% figures apply to Sophos MDR cases using Daybreak-powered agents, within boundaries set by Sophos analysts. The case study does not disclose the total case volume, the types of attacks covered, or the false-positive/false-negative rates of the automated resolutions. The 89-second average is for cases using the agents, not all cases. Sophos analysts still handle the remaining 48% and the judgement-critical decisions within automated cases.
Security teams should evaluate model-assisted investigation within calibrated boundaries
The pattern--combining a capable model with organization-specific threat intelligence, playbooks, and analyst-calibrated autonomy boundaries--is reproducible. Security teams using MDR or similar services should ask their providers what fraction of cases are automated, what the human-in-the-loop boundaries are, and how the system handles novel attack patterns outside the calibrated space.