An October 9 OpenAI customer case study says Sophos has built investigation and response agents through the Daybreak program. It describes company-reported operational results rather than an independent comparison of cybersecurity products.
The study says average response time for cases using those agents fell from approximately 38 minutes to 89 seconds. Its headline describes a 96 percent reduction in investigation time. These measures concern the cases using agents, not every alert, every customer or guaranteed containment time for an attack.
OpenAI reports that Sophos resolves 52 percent of managed detection and response cases end-to-end with AI, within boundaries calibrated by analysts. The study does not say all cases are automated or that security staff are no longer needed.
The described workflow gathers customer context, detections, indicators and threat intelligence, then builds and reviews an investigation plan. It produces a summary and recommended actions for analyst review; other agents can carry out parts of a response. These are described capabilities, not proof of error-free decisions.
Sophos uses Notify, Collaborate and Authorise operating modes to distinguish customer action, joint work and direct response on the customer's behalf. The case study says these boundaries apply to people and agents, with potentially destructive actions still requiring the appropriate human oversight.
Limits: the article does not provide an independent audit, a randomized comparison or enough detail to generalize the figures to another security team. Faster average handling is not evidence that every threat is detected or prevented. Evaluate case scope, authorization and exceptions alongside the reported speed.