Sophos cuts threat investigation time by 96% with OpenAI Daybreak

Sophos, a cybersecurity firm, has disclosed that it deployed OpenAI's Daybreak platform to accelerate its threat investigation workflows. The company says the AI tool reduced investigation time by 96% and automated 52% of managed detection and response (MDR) cases, with human analysts retaining final oversight on decisions.

Daybreak appears to be an OpenAI offering aimed at enterprise security operations, combining large language model capabilities with workflow automation tailored to threat hunting and incident triage. Sophos's use case centers on MDR, where analysts traditionally sift through large volumes of alerts and logs to identify genuine threats.

The case matters because it illustrates a concrete enterprise application of LLMs in a high-stakes, time-sensitive domain. Cybersecurity operations have long struggled with alert fatigue and analyst shortages, making automation that preserves human judgment a practical value proposition.

If the reported figures hold across broader deployments, the result could signal a shift in how security teams staff and structure their operations, with AI handling routine triage and escalation while humans focus on complex or ambiguous incidents. Sophos has not published independent benchmarks, so the numbers should be treated as vendor-reported until third-party validation emerges.

This page provides an editorial summary based on publicly available information. It is not a republished article. Use the source link below for the original report.