Cybersecurity has traditionally operated under a difficult imbalance: attackers need only one successful intrusion, while defenders must continuously monitor enormous volumes of activity across increasingly complex environments. Even when security tools detect suspicious behavior almost immediately, determining whether an alert represents a genuine threat can require substantial investigation. Analysts must reconstruct events, correlate information from different systems, evaluate potential indicators of compromise and decide whether intervention is necessary. That process consumes valuable time, particularly when security operations centers are simultaneously handling hundreds of incidents. Now,Sophos says its collaboration withOpenAI is demonstrating how dramatically artificial intelligence could change that equation.
In a case study published on October 9, 2026, Sophos reported that AI agents developed through OpenAI Daybreak reduced average investigation and response times from approximately 38 minutes to just 89 seconds, a 96% improvement for cases handled by the new system. The company also revealed that 52% of its Managed Detection and Response (MDR) cases are now resolved end-to-end by AI, operating within boundaries established by security specialists. These figures represent more than an incremental improvement in automation. They suggest that agentic AI is beginning to assume responsibility for investigative workflows that previously required substantial human involvement, potentially changing how cybersecurity services are delivered, scaled and managed.
From Alert Overload to Autonomous Security Investigations
The scale of Sophos’s security operations helps explain why the company has invested in autonomous investigation technology. Protecting more than 625,000 organizations worldwide, Sophos operates a security ecosystem that collects telemetry from its own products and more than 500 third-party integrations. Together, these systems generate trillions of security events every day, which are progressively filtered and correlated into approximately 1,000 to 2,000 cases requiring investigation across nine security operations centers. Although modern detection platforms already automate significant portions of event collection and correlation, determining what happened, whether an attacker is involved and what should happen next has historically depended on experienced security analysts.
The traditional investigation process involves considerably more than examining an isolated alert. An analyst investigating suspicious authentication activity, for example, may need to review identity logs, endpoint telemetry, network connections, historical behavior and threat intelligence before deciding whether the activity indicates credential theft or legitimate administrative work. Each additional source introduces context that can improve the decision, but gathering and interpreting that information takes time. Sophos’s approach attempts to automate much of this reasoning-intensive process by deploying AI agents capable of collecting evidence, organizing investigative steps and producing findings that can be reviewed or acted upon according to predefined security policies.
At the center of the implementation is Sophos Fusion, the company’s AI-native cybersecurity platform, which integrates its Managed Detection and Response capabilities with information collected across customer environments. An investigation agent begins by gathering relevant customer context, detections, indicators of compromise and threat intelligence. A planning model then organizes the work through a structured plan–execute–review cycle, determining which investigative steps are necessary, carrying them out and evaluating the resulting evidence before producing a summary and recommended response actions. Other agents can participate in subsequent response activities when the operational configuration permits them to do so. The result is an architecture designed to handle investigations as coordinated processes rather than isolated automation tasks.
This distinction is important because conventional security automation has generally depended on predefined rules and workflows. Security orchestration platforms can automatically enrich alerts, block known malicious indicators or execute response playbooks, but they often struggle when an incident requires adapting the investigation to unexpected evidence. Agentic systems introduce a more flexible approach by allowing models to determine which information is relevant and which investigative actions should follow. That flexibility could make automation applicable to a wider range of security incidents, although it also introduces new requirements for validating conclusions, controlling permissions and ensuring that the system does not confuse plausible explanations with verified evidence.
Why Reducing Investigation Time Matters
Sophos’s reported reduction from 38 minutes to 89 seconds has implications beyond operational efficiency. In cybersecurity, the period between detecting suspicious activity and taking effective action can determine whether an attacker remains confined to an initial foothold or progresses toward more damaging objectives. Compromised credentials can be used to access additional services, malicious processes can establish persistence, and stolen information can be transferred outside an organization’s environment while defenders are still evaluating the first warning signs. Compressing the investigative process therefore creates an opportunity to intervene earlier, provided that the resulting decisions are sufficiently accurate and appropriate for the situation.
The company’s previous average investigation and response time of approximately 38 minutes was already considered competitive by its leadership. Achieving an average of 89 seconds for agent-assisted cases represents a different operating model, in which significant portions of investigative work can be completed at machine speed. Instead of spending most of their time collecting logs and assembling incident timelines, human analysts can potentially focus on ambiguous cases, complex attack chains and decisions requiring contextual judgment. This shift is especially relevant because experienced cybersecurity professionals remain difficult to recruit and retain, while the number of connected systems and potential attack surfaces continues to expand.
There is also an economic dimension to the deployment. Managed security providers traditionally increase their investigative capacity by hiring additional analysts, improving automation or reducing the number of cases requiring human attention. Sophos’s approach introduces another possibility: expanding investigative capacity through computing resources and AI agents without requiring equivalent growth in staffing. If the technology maintains its effectiveness as workloads increase, it could allow security providers to support larger customer populations while preserving specialist attention for the incidents that genuinely require it. However, the reported figures come from a customer case study published by OpenAI, and the announcement does not provide independently verified measurements of investigation accuracy, false-positive rates or performance across different incident categories.
Those limitations matter because speed alone is an incomplete measure of security effectiveness. An automated investigation that reaches the wrong conclusion in 89 seconds may be less useful than a slower process that accurately identifies a sophisticated intrusion. Similarly, resolving a high proportion of routine cases does not necessarily demonstrate that AI can reliably investigate advanced persistent threats, complex identity compromises or incidents involving incomplete telemetry. Evaluating the long-term value of agentic security operations will require understanding not only how quickly agents complete investigations, but also how frequently their conclusions are correct, when they escalate uncertainty and whether they consistently identify the full scope of an attack.
Autonomous Response Still Requires Human Judgment
One of the most consequential questions surrounding agentic cybersecurity concerns the authority granted to automated systems. Investigating suspicious behavior and recommending a response is fundamentally different from disabling user accounts, isolating production servers or blocking network communications. While those actions may be necessary to contain an active intrusion, incorrect intervention can interrupt legitimate operations, prevent employees from accessing critical services or create additional problems during an already disruptive incident. As AI agents become more capable of initiating actions independently, organizations must determine where automation should end and human authorization should begin.
Sophos addresses this challenge through three operational modes that define how its Managed Detection and Response service interacts with customers. Under Notify, Sophos investigates incidents and recommends actions, leaving execution to the customer.Collaborate establishes a shared decision-making process before response measures are implemented, while Authorise permits Sophos to take action directly on the customer’s behalf. Crucially, these boundaries apply whether an investigation is performed by a human analyst or an AI agent, preventing the introduction of automation from automatically expanding the authority available to the service. Sophos also states that situations outside an agent’s permitted capabilities or appropriate level of confidence are escalated for human judgment.
This governance model highlights an important distinction between technical capability and operational responsibility. An AI system may be capable of identifying a suspicious process and recommending that its host be isolated, but the authority to perform that action should depend on business context, organizational policy and the potential consequences of intervention. A compromised employee laptop and a production database server may require different response strategies, even when their security telemetry contains similar indicators. Effective agentic security therefore depends on integrating model reasoning with established authorization controls, escalation procedures and incident response policies rather than allowing autonomous agents to operate without meaningful restrictions.
The same principle applies to the reliability of the evidence used during investigations. Security telemetry is frequently incomplete, contradictory or affected by configuration differences between environments, making accurate interpretation challenging even for experienced analysts. AI agents must distinguish between confirmed malicious activity, suspicious behavior requiring further investigation and ordinary operational anomalies. Their ability to produce coherent explanations should not be mistaken for certainty, particularly when the underlying evidence is ambiguous. Maintaining human oversight for exceptional or potentially destructive decisions remains essential as organizations experiment with increasingly autonomous security operations.
The Next Phase of AI-Driven Cybersecurity
Sophos’s deployment arrives as artificial intelligence is changing the capabilities available to both attackers and defenders. Advanced models can assist security teams with vulnerability research, threat analysis and incident investigation, but similar capabilities can also help malicious actors identify weaknesses, automate reconnaissance and accelerate parts of the exploitation process. As these technologies become more accessible, the time available to investigate and contain threats may continue to narrow. Security operations built around lengthy manual investigations could struggle to respond effectively when attackers can automate substantial portions of their own workflows.
Agentic AI offers a potential response to that pressure by accelerating the work between detection and containment. Rather than replacing conventional cybersecurity tools, systems such as Sophos’s build upon existing telemetry, threat intelligence and operational procedures to automate how information is interpreted and used. This is an important architectural distinction: the effectiveness of an AI investigation depends heavily on the quality of the underlying security infrastructure, the completeness of available evidence and the permissions granted to the system. Sophos itself emphasizes that organizations must continue investing in foundational protections such as endpoint security, multifactor authentication, network segmentation and vulnerability management, regardless of how sophisticated their automated investigations become.
The company’s next objective is to expand the range of investigative and response activities its agents can perform, potentially moving more security operations toward autonomous execution. Whether that transition succeeds will depend on demonstrating that faster investigations remain accurate, explainable and appropriately governed as their complexity increases. Organizations will also need to develop ways to evaluate agent performance continuously, including how systems behave when confronted with unfamiliar attacks, misleading evidence or situations that fall outside established response procedures.
The broader significance of Sophos’s results lies in the changing relationship between human expertise and machine-driven security operations. For decades, cybersecurity teams have relied on increasingly sophisticated detection technologies while leaving much of the investigative burden to human analysts. Agentic AI is beginning to challenge that division of labor by automating not only the collection of security information but also substantial portions of its interpretation. If these systems can consistently deliver reliable conclusions under appropriate controls, security professionals may spend less time reconstructing routine incidents and more time addressing sophisticated threats that demand experience, creativity and judgment.
The future of cybersecurity may depend less on generating additional alerts and more on transforming existing security intelligence into accurate, timely decisions. Sophos’s deployment suggests that AI agents could significantly accelerate that transition, but their lasting value will ultimately be measured by the attacks they help prevent, not simply the minutes they save.