Sophos says AI agents cut threat investigations to 89 seconds

What changed

Sophos says its average investigation-and-response time for cases handled with Daybreak agents fell from roughly 38 minutes to 89 seconds, a 96% reduction. It also reports that AI now resolves 52% of its managed detection and response cases end-to-end, inside boundaries set by Sophos analysts.

The workflow is more specific than a chatbot summarizing alerts. Sophos says an investigation agent gathers customer context, detections, indicators of compromise and threat intelligence. A planning model then creates a plan–execute–review loop and returns a summary with recommended response actions. Other agents can perform parts of the response.

What the result actually shows

Sophos operates sensors across more than 500 third-party integrations and distills trillions of daily events into about 1,000 to 2,000 cases for its security operations teams. That filtering step matters: the reported speedup is for cases in an established managed-security pipeline, not a claim that AI autonomously handles every alert or replaces incident responders.

The company describes three control modes: notify, collaborate and authorize. In the first, the customer acts on recommendations; in the last, Sophos may respond directly. Potentially destructive actions still require the appropriate oversight. The result is a useful example of agents taking repetitive triage work while humans retain escalation and risk boundaries.

The accompanying Sophos AI-agent graphic is from a separate product overview and illustrates the company’s agent workflow; the 89-second and 52% figures above come from the Daybreak case study.