OpenAI Daybreak cuts Sophos investigation time

Daybreak’s strongest signal is workflow integration, not model novelty: the agents turn Sophos’s telemetry, threat intelligence, and playbooks into a governed investigation loop.

• –Agents correlate data from 500+ integrations and distill trillions of daily events into actionable cases.
• –A plan-execute-review loop gathers evidence, investigates indicators of compromise, and recommends response actions.
• –The 96% improvement is a vendor-reported customer result, applying to cases handled by the agents rather than every MDR incident.
• –Notify, Collaborate, and Authorise modes preserve human oversight for disruptive or uncertain responses.
• –The case supports managed security partnerships as a practical route for deploying frontier models without exposing customers directly to them.