Sophos Cut Threat Investigation Time by 96% With AI

A cybersecurity company just published a number worth paying attention to, even if you have never heard of them. According to an OpenAI case study published October 9, 2026, Sophos used OpenAI's Daybreak model to cut the time it takes to investigate a cyber threat by 96 percent, and to automate 52 percent of its managed detection and response cases entirely, while keeping a human in the loop for final decisions. That is not a pilot program result. That is a production outcome from a company that handles security for tens of thousands of businesses.

I want to be upfront: the source page was unavailable when I went to pull the full detail, so I'm working from what OpenAI published in their announcement summary. I won't fill in what I can't confirm. But the two numbers they did publish, 96 percent and 52 percent, are specific enough to be useful, and the pattern they represent is what I want to talk about.

What happened, as plainly as I can say it

Sophos runs what's called a managed detection and response service, or MDR. Think of it as a security operations center you hire rather than build. Their analysts watch for threats across client networks around the clock, investigate alerts, and decide which ones are real. That last part, the investigation, is where the time goes. Analysts have to pull data, correlate events, look for patterns, and write up what they found.

OpenAI's case study says Sophos plugged their Daybreak model into that investigation step. The result was a 96 percent reduction in investigation time and, separately, 52 percent of MDR cases now run without a human analyst touching them at all. Human oversight is still there for the final call on serious threats. But the grunt work, the reading, correlating, and summarizing that an analyst used to do manually, is now done by the model.

OpenAI has not disclosed what Daybreak costs or how it is priced for enterprise customers. I won't guess at that number.

The analyst-replacement pattern

Here is the thing worth naming. This is not AI helping an analyst work faster. This is AI doing what the analyst used to do, and the analyst stepping back to review the output rather than produce it. There is a meaningful difference, and it has a name I want you to remember: the transition from co-pilot to primary.

A co-pilot AI surfaces options and the human chooses. A primary AI acts, and the human reviews. The co-pilot model has been the story for the last three years. Sophos is describing the primary model, in production, at scale, in a field where being wrong has serious consequences. That's the news inside the news.

I have been watching this transition happen in smaller ways in the businesses I work with. We built an AI receptionist for a practice that was missing roughly 40 calls a month. The system does not assist a receptionist. It takes the call. The human reviews bookings in the morning. Same pattern. The AI is primary. The human reviews. Once you see that shift, you see it everywhere, and you start asking which roles in your own operation are actually review roles that have been disguised as production roles.

What this means if you're not a cybersecurity company

You probably don't run a threat investigation team. So why does this matter to you?

Because the 96 percent number is not about cybersecurity. It is about what happens when you give a capable AI model a well-defined knowledge-work task with clear inputs and a clear output, and you let it run. The Sophos analysts were not doing something magical. They were reading data, comparing it to patterns, writing a summary, and making a recommendation. That is, roughly, what a lot of people in a lot of businesses do every day.

If you have a team member whose job is to gather information, compare it to what you already know, and produce a recommendation or a report, that role is in the early stages of the co-pilot-to-primary transition right now. Billing reviews. Intake coordination. Estimate preparation. Content research. Insurance verification. The Sophos story is a reminder that 52 percent automated is not the ceiling. It is probably a first pass.

I wrote earlier this year about a company that knocked out 80 percent of its support tickets for $700 a month. Same pattern, different department. And if you want to understand the organizational thinking that makes this work without chaos, Skyline Chili's approach to building an org chart for AI is the clearest framework I have seen a smaller company publish.

Under the hood, for the reader who wants it

Daybreak is an OpenAI model, and that is about as much as the published summary tells us about its architecture. What we can infer from the outcome is that Sophos is using it as an agentic layer, meaning the model is not just answering questions but taking a sequence of actions: pulling relevant data, running comparisons, generating a structured output, and routing the result based on confidence. The 52 percent automation figure suggests there is a threshold in their system; cases above a certain confidence score proceed without human review, and cases below it get flagged. That is a standard agentic design and it is the right design for anything consequential. The 96 percent time reduction on the cases that do get human review suggests the model's output is good enough that the analyst is genuinely reviewing rather than redoing. That distinction matters. If your AI is producing work the human has to redo, you have a co-pilot that is slower than just doing it yourself.

What to do this week

First, do a 20-minute audit of one knowledge-work role in your business. Not the whole operation. Pick the one where the most time goes into gathering and summarizing information before someone makes a decision. Write down the inputs and the expected output. If you can describe the task in one paragraph, an AI can probably do a first draft of it.

Second, if you use a managed IT or security provider, ask them this week whether they are using AI in their investigation or triage process. Not because you need a 96 percent improvement. Because if they're not, their response times are slower and their costs are higher than they need to be, and you are probably paying for it.

Third, watch what OpenAI publishes in this case study series. The Sophos piece is part of a pattern of enterprise case studies with real production numbers. Those numbers are useful anchors when vendors come to you with demos and projections.

You can skip this one if

You're a solo operator, you have no staff whose primary job is information synthesis, and your security is handled by a basic managed IT provider you already trust. This news does not change your week. File the 96 percent figure somewhere and come back to it when you're thinking about hiring your next coordinator or analyst.

One question I'd ask a peer

Which role in your business do you describe as "strategic" that is actually mostly pattern recognition and report writing? Because that's the one worth looking at first. AI doesn't care about the title. It cares about the task. And if the task is reading data and producing a recommendation, the primary-to-review shift is already closer than the org chart suggests.

The AI stops being a co-pilot and starts being the analyst. That pattern is coming for every knowledge-work role. The only question is whether you notice it before or after the hire you were about to make.

Sources

• Sophos cuts threat investigation time by 96% with OpenAI Daybreak, OpenAI News, October 9, 2026