What changes when security agents handle the investigation loop?

Sophos says agents built through OpenAI Daybreak reduced average response time for cases using those agents from approximately 38 minutes to 89 seconds. OpenAI’s account also says Sophos resolves 52% of Managed Detection and Response cases end-to-end with AI, within boundaries calibrated by its analysts. [9] Why it matters: This is a shift from AI assisting an analyst to agents executing substantial portions of a security workflow. Customer operating modes and human oversight remain important because the system can recommend response actions and other agents can carry out parts of the response. [9] Key insights: An investigation agent gathers customer context, detections, indicators of compromise and threat intelligence; a planning model then runs a plan–execute–review loop. [9] | Sophos distills trillions of daily sensor events into roughly 1,000 to 2,000 cases for nine security operations centres, putting the agents downstream of an existing filtering process. [9] | The 89-second figure applies to cases using the agents, not necessarily every case Sophos handles; the separate 52% figure describes end-to-end AI resolution. [9] | Customers can retain responsibility for acting, work jointly with Sophos or authorize Sophos to respond directly on their behalf. [9] Cheatsheet facts: What changed: Agents now investigate and resolve 52% of MDR cases end-to-end within analyst-calibrated boundaries, according to OpenAI’s account. [9] | Why now: Daybreak agents combine models with Sophos threat intelligence and response playbooks to automate the investigation loop. [9] | Watch next: Track the share of cases resolved end-to-end and response times for agent-handled cases—the two distinct measures Sophos currently reports. [9]