From 38 minutes to 89 seconds
Sophos says cases handled by its Daybreak agents now take an average of 89 seconds to investigate and respond, compared with about 38 minutes in its previous process. The company says agents resolve 52% of managed detection and response cases end-to-end.
The workflow gathers customer context, detection signals and threat intelligence, then follows a plan–execute–review loop. It produces a summary and recommended actions for analysts; other agents can perform selected response steps.
The deployment is bounded
Sophos says its security platform ingests trillions of events from more than 500 integrations, then narrows them to roughly 1,000–2,000 cases a day for its security operations centers. The agent is operating inside that existing expert service, not replacing the whole security team.
Customers can choose notification, collaboration or authorized response modes. Sophos says potentially destructive actions remain subject to the appropriate customer control. The figures come from the company’s October 9 case study, so they describe its own deployment rather than an independent industry-wide result.
Source published 2026-10-09. Coverage is based on the maker’s announcement and demonstration.