Quick Overview
This fireside chat from OpenAI's Intelligence at Work: Cyber event features Claire Lawlor from OpenAI interviewing John Peterson, Chief Technology Officer at Sophos. The discussion focuses on how Sophos incorporates OpenAI's Daybreak program into its cybersecurity operations to automate threat investigations and support security teams.
Key Points
- 1.Sophos uses OpenAI's Daybreak program to build automated AI agents for cybersecurity threat detection and investigation.
- 2.Implementing AI agents reduced average investigation times for supported security cases from 38 minutes to approximately 89 seconds.
- 3.AI agents currently automate approximately half of the daily security cases processed across Sophos's security operations centers.
- 4.Sophos operates across three customer response modes, Notify, Collaborate, and Authorize, ensuring human judgment oversees potentially destructive remediation actions.
- 5.Maintaining core cybersecurity fundamentals like endpoint protection, multifactor authentication, network segmentation, and patching remains essential alongside AI adoption.
Summary
Claire Lawlor opens the conversation by introducing John Peterson, Chief Technology Officer at Sophos. Peterson outlines Sophos's scale as a global cybersecurity provider serving approximately 650,000 customers across all industry sectors, drawing on four decades of cybersecurity domain experience.
Lawlor asks about the concept of the narrowing defender's window and what it means for Sophos as an OpenAI Daybreak partner. Peterson explains that frontier intelligence models are advancing quickly, with those capabilities steadily moving down into open-weight models. This progression accelerates attacker exploitation paths and increases the volume of common vulnerabilities and exposures. To stay ahead of attackers, Sophos uses OpenAI's Daybreak program to integrate frontier AI capabilities into defender workflows.
Peterson details how this works within the Sophos Fusion system, which powers the company's Managed Detection and Response service as well as its EDR and XDR products. The platform ingests telemetry from over 500 integrations with third-party tools and proprietary sensors, generating trillions of events daily. These events are distilled into 1,000 to 2,000 daily cases investigated across nine global security operations centers. Historically, human-led investigations took an average of 38 minutes per case, outperforming 96 percent of professional security operations centers. By deploying AI investigation agents built with Daybreak models, Sophos reduced average response and investigation times for supported cases to approximately 89 seconds, with agents now handling roughly half of all incoming cases.
The AI agents operate in a plan, execute, and review cycle, taking case context, telemetry, and indicators of compromise to generate an investigation plan, carry out analysis steps, compile summaries, and suggest remediation. When acting on findings, Sophos applies three operating modes: Notify, where Sophos investigates and recommends actions without direct intervention; Collaborate, where analysts work directly with the customer before taking action; and Authorize, where Sophos has full authorization to execute response actions on the customer's behalf. Peterson notes that human judgment remains embedded in the workflow to supervise any response action that could prove destructive to a customer's environment.
In closing, Peterson stresses that the acceleration of AI does not replace foundational cybersecurity controls. Organizations must continue prioritizing core practices, including strong endpoint protection, multifactor authentication across identity systems, network segmentation, and regular vulnerability patching. Using AI agents allows security teams to scale compute rather than personnel while reinforcing baseline operational defenses.
The Narrowing Defender's Window
Peterson explains that frontier AI capabilities are developing rapidly and filtering into open-weight models, driving faster exploitation paths and increasing common vulnerabilities and exposures (CVEs). Through programs like OpenAI's Daybreak, security defenders can leverage frontier intelligence to stay a step ahead of attackers.
Automating SOC Investigations with AI Agents
Sophos Fusion ingests sensor data across more than 500 integrations, distilling trillions of daily events into 1,000 to 2,000 cases handled across nine security operations centers. AI agents built with Daybreak models execute investigation plans, reducing average investigation times from 38 minutes down to 89 seconds across roughly half of incoming cases.
Human Judgment and Response Modes
Sophos structures its response operations into three modes: Notify, Collaborate, and Authorize. While AI agents automate data gathering and recommend actions, human analysts remain responsible for supervising high-risk or potentially destructive remediation measures to ensure safe execution in customer environments.
Reinforcing Cybersecurity Fundamentals
Despite advances in AI agent automation, basic security hygiene remains paramount. Peterson emphasizes that organizations must pair AI-driven security operations with solid endpoint protection, comprehensive multifactor authentication across identity infrastructure, network segmentation, and disciplined patching programs.
The Bottom Line
The session establishes that applying frontier AI models to security operations enables defenders to automate incident investigation workflows and reduce case analysis times from 38 minutes to 89 seconds. It demonstrates how AI agents can scale detection and planning capacity across high case volumes while maintaining human oversight for critical and potentially disruptive remediation decisions. The discussion lands on the principle that AI tools must enhance rather than replace foundational security practices like endpoint defense, multifactor authentication, and patch management.
FAQ
What is Sophos and what is its role as an OpenAI Daybreak partner?
Sophos is a global cybersecurity provider protecting approximately 650,000 customers worldwide. As an OpenAI Daybreak partner, Sophos integrates frontier AI models into its security systems to build automated agents that accelerate threat detection, investigation, and response.
What does the narrowing defender's window mean for cybersecurity operations?
The narrowing defender's window refers to the shrinking timeframe defenders have to protect systems as frontier AI capabilities accelerate and become available in open-weight models, enabling attackers to discover vulnerabilities and execute exploitation paths faster.
How does the Sophos Fusion platform handle security event telemetry and cases?
Sophos Fusion connects to over 500 third-party and native integrations, capturing trillions of sensor events each day. It distills this telemetry into 1,000 to 2,000 daily cases that are investigated across nine security operations centers.
How significantly do AI agents reduce case investigation times in Sophos security operations?
AI agents developed through the Daybreak program reduced the average investigation and response time on supported cases from 38 minutes down to approximately 89 seconds, while automating roughly half of the total case volume.
What are the three response modes Sophos uses when managing customer security incidents?
Sophos operates under Notify mode, where findings and recommendations are shared without direct action; Collaborate mode, where actions are taken only in direct coordination with the customer; and Authorize mode, where Sophos is fully empowered to execute response actions on the customer's behalf.
What core cybersecurity fundamentals does John Peterson emphasize alongside AI adoption?
Peterson emphasizes maintaining robust endpoint protection, multifactor authentication across all identity infrastructure, strong network segmentation, and structured vulnerability patching programs.
Worth watching for
Cybersecurity leaders, security operations managers, and SOC analysts interested in applying frontier AI models and automated agents to scale threat investigation and incident response.
- openai
- sophos
- cybersecurity
- ai-agents
- soc-automation
- threat-detection