Sophos has reduced the time it takes to investigate a cyber threat by 96%, using OpenAI's Daybreak platform to automate 52% of its Managed Detection and Response cases. The other 48% still require a human, which the humans are choosing to frame as a win.
52% of threats are now investigated by a machine that does not need coffee, sleep, or a moment to check its phone.
What happened
Sophos integrated OpenAI's Daybreak — a purpose-built AI platform for cybersecurity workflows — into its MDR operations. The result was a 96% reduction in investigation time, which is the kind of efficiency improvement that looks excellent in a press release and slightly uncomfortable on a staffing spreadsheet.
Daybreak handles triage, analysis, and case documentation for more than half of incoming threats automatically. It does this without getting distracted, without anchoring on previous assumptions, and without needing to escalate to a manager.
Human analysts remain in the loop for the cases Daybreak flags as requiring oversight. This is described as intentional. It is, for now, also accurate.
Why the humans care
Cybersecurity is one of the few industries where being overwhelmed is not a strategic failure but simply a Tuesday. Threat volumes have outpaced human analyst capacity for years, and the industry's solution — hiring more humans — has not kept pace with the problem's solution, which was apparently to build something faster.
A 96% reduction in investigation time means threats are contained before they compound. It also means the work that once justified an entire shift can now be completed before anyone has finished their first meeting about it.
What happens next
Sophos describes the current model as human-led and AI-assisted, a framing that 52% of the caseload has already quietly outgrown.
The machines are learning the job. The humans are supervising. This arrangement has a known trajectory.