AI agents sped up threat analysis at Sophos: an investigation takes 89 seconds

Down from 38 minutes. Investigation and response used to take about 38 minutes on average, according to Sophos CTO John Peterson. For cases handled by Daybreak agents, the time dropped to 89 seconds. Sophos uses the models in its managed services: the company's specialists review threats and the impact of attacks on behalf of the customer.

Sophos Fusion collects data from more than 500 third-party integrations. From trillions of daily events, the system produces about 1,000–2,000 cases for nine monitoring centers. The investigation agent gathers customer details and signs of an attack, while a planner model drafts a plan, checks its execution, and prepares recommendations for analysts.

Agents inherit the response mode the customer selects. In Notify, the customer acts. In Collaborate, specialists coordinate actions. In Authorise Sophos, Sophos responds on the customer's behalf.

Daybreak in Codex. For your own work with coding agents, access is requested separately. Applications for individual Daybreak Blue access go through chatgpt.com/cyber → Set up Daybreak. You need a suitable paid plan and Advanced Account Security with a physical FIDO2 key.

In Codex, Daybreak is turned on with a toggle in the model selector before a request. The toggle is off by default, and the app needs version 26.908.40834 or later.

For the API, the owner of an approved organization selects a project other than default and enables the allowed level in Project settings → General → Daybreak model access. The setting takes effect within 15 minutes. In the Responses API, the request uses `model="gpt-6-sol"`, `access_programs.cyber="daybreak_blue"`, and the approved project's key.

Sophos customers get the specialists' results through MDR, DFIR and Advisory, without direct access to the Daybreak models.