◆ AI AT WORK · Workflows
Sophos says AI closes 52% of its MDR cases
The News
OpenAI's October 9, 2026 customer story covers Sophos's managed detection and response (MDR), which monitors and responds to threats 24/7. Sophos's technology chief, John Peterson, says agents developed using OpenAI's Daybreak models automate about half its cases. On May 28, Sophos reported 52% of MDR cases closed end-to-end by AI, without human intervention required, inside boundaries continuously calibrated by analysts.
Chandni Melwani
Founder & Editor
Oct 18, 2026 · 1 MIN READ
Know More
- — Speed: 89 seconds from case creation to fully automated response, on cases AI is authorised to resolve, Sophos says.
- — Basis: production data from a full year of agentic operation inside Sophos MDR, by Sophos's own count.
- — Workload: trillions of events every day, distilled into roughly 1,000 to 2,000 cases for nine security operations centres, per OpenAI.
- — Team: Sophos MDR lists analysts, AI and automation engineers, threat hunters, incident responders, detection engineers and threat researchers.
Sophos described two production-grade AI agents in its MDR service in a February 10, 2026 blog, both “designed by our in-house AI team and refined with our MDR analysts.” The triage agent sets each new case’s severity, deciding whether analyst review is required.
On May 28, Sophos said AI handles the volume that once consumed Tier 1 and much of Tier 2 analyst time, and that analysts shifted to threat hunting, investigation, customer advisory and “governance of the autonomous systems themselves.” “The 52% gets the attention, but the 48% is just as important,” said Rob Harrison, Sophos’s senior vice-president of product management.
In June, Sophos says, it gained access to OpenAI’s cyber models “to strengthen our products and threat intelligence.” In OpenAI’s October 9 story, an investigation agent gathers the customer context, detections, indicators of compromise and relevant threat intelligence for each case, and a planning model runs a plan–execute–review loop, summarising recommended response actions for analysts to review.
The Read
Sophos's MDR customers rose 39% in a year to 40,000, by its May count, and OpenAI's account says the work 'helps Sophos scale compute rather than relying on equivalent growth in scarce cybersecurity headcount.' Sophos's analyst team will probably grow more slowly than its customer base, as Peterson says Sophos will 'broaden the range of use cases' its agents address.
Room for Disagreement
The headcount line comes from OpenAI's customer story, and no Sophos source we read gives analyst numbers or hiring plans. Rob Harrison says the 48% AI doesn't close is 'just as important,' and Sophos lists threat hunting, customer advisory and governance of the autonomous systems as analysts' work.
Related
Frequently Asked Questions
Does 'end-to-end by AI' mean no analyst is involved?
No analyst has to step in on those cases, Sophos says, but analysts continuously calibrate the boundaries and supervise the AI. Sophos says the figure measures 'the volume of work AI is doing autonomously, not just alert triage or threat containment.' It runs human-on-the-loop 'for the high-volume, well-bounded work where speed matters' and human-in-the-loop 'for high-stakes decisions where context, business impact, or novel adversary behavior require an analyst's judgment before action.'
Which OpenAI models do Sophos's agents use?
OpenAI's customer story names no specific model, and John Peterson, Sophos's chief technology officer, refers to 'the Daybreak models.' A Sophos release dated September 3, 2026, about its Managed Risk service, says one new capability 'will be built with OpenAI's GPT cyber models,' and that through Daybreak, which Sophos joined in June 2026, it 'brought frontier cyber models into MDR investigation, advisory assessments, and workflows that help customers discover, validate, and remediate exposure.' Sophos says customers get no direct access to the models.
Can Sophos act on a customer's systems without asking?
Sometimes, depending on the Threat Response Mode the customer or its MSP selects. Sophos's MDR service description, revised October 9, 2026, lists Authorize, which grants 'pre-authorization to Sophos to perform Threat Response,' with notice after Response Actions; Collaborate, where 'no Response Actions are taken without Customer/MSP's written consent,' although 'certain Response Actions such as remote query or evidence collection may be undertaken without Customer consent or involvement'; and Notify Only, where Sophos investigates and provides remediation guidance. A 'Collaborate then Authorize' option switches Sophos to Authorize mode if it gets no acknowledgment after reasonable attempts to reach all the contacts the customer defined. 'Anything we don't feel comfortable with an agent handling gets passed off for human judgement,' Peterson says in OpenAI's story.
Sources
- OpenAI, 'Sophos cuts threat investigation time by 96% with OpenAI Daybreak,' customer story, October 9, 2026. Source for what the investigation agent and planning model do, the 1,000 to 2,000 cases, the headcount line in its results list and John Peterson's quotes.
- Sophos, 'Sophos Managed Detection and Response – Service Description,' revision date October 9, 2026. Source for the Threat Response Modes: Authorize, Collaborate, Collaborate then Authorize, and Notify Only.
- Sophos blog, Elvis Hovor, 'Sophos AI Agents: Accelerating MDR and Powering the Agentic SOC,' February 10, 2026. Source for the two in-house agents and what the triage agent does.
- Sophos, 'Sophos' Agentic SOC Compresses Threat Response to 89 Seconds,' press release, May 28, 2026. Source for the 52% and 89-second figures and what each measures, the 40,000 MDR customers and 39% growth, the Tier 1 and Tier 2 line, the analysts' new work, the human-on-the-loop and human-in-the-loop split, and Rob Harrison's quote.
- Sophos, 'Sophos Joins the OpenAI Daybreak Cyber Partner Program to Strengthen Customer Defense with Frontier AI,' press release, June 22, 2026. Source for customers having no direct access to the models.
- Sophos blog, John Peterson, 'Sophos Working with OpenAI on security from AI, with AI, and for AI,' August 10, 2026. Source for Sophos gaining access to OpenAI's cyber models in June.
- Sophos, 'Sophos To Bring OpenAI GPT Cyber Models Into Managed Risk Offering, Helping Defenders Validate Exploit Paths,' press release, September 3, 2026. Source for 'OpenAI's GPT cyber models' and frontier cyber models in MDR investigation.
- Sophos, 'Sophos MDR' service page. Source for what managed detection and response is, analysts supervising the AI, and the MDR team's roles.
Chandni Melwani
Chandni Melwani is the founder and editor of New in AI, covering AI agents, M&A, and enterprise adoption. She holds a Master's in Management of Artificial Intelligence from Queen's University and brings a practitioner's perspective from her work in Data and AI leadership.
Follow ↗AI at Work Briefing
Get the five-beat briefing in your inbox.
The big story, frontier labs, AI at work, e-commerce and the capital crossing borders, each with the part that tells you why it matters, not just that it happened.
Free · No spam · Unsubscribe in one click
More from AI at Work
Jobs
Anthropic reports juniors fell to 9% of its technical hires
Anthropic's October 16, 2026 report on its own workforce says junior employees' share of its technical departments slipped from 21% to 14% since early 2025. It says the proportion of junior technical hires fell from 27% to 9% as hours worked by AI agents rapidly expanded relative to employees'.
Chandni Melwani · US · Oct 21, 2026
Jobs
Five Fed districts report some firms hiring less after AI
Some firms in five Fed districts reduced staff through attrition, delayed hiring or expected less job creation after AI investment raised productivity, the October 2026 Beige Book says. Most districts described little or no net change in overall employment levels.
Chandni Melwani · US · Oct 20, 2026
Jobs
DNB to cut about 400 full-time equivalents, citing AI agents
Norway's DNB will cut about 400 full-time equivalents in Technology & Services. Finansforbundet, a finance-sector union, says lower staffing is only one way to take the gains AI can bring.
Chandni Melwani · Norway · Oct 8, 2026