Sophos, a cybersecurity software company, says its agents close just over half (52%) of cases in its managed detection and response (MDR) service without human intervention.
Sophos first disclosed that figure in May, along with an average of 89 seconds from case creation to automated response. A case study from OpenAI, the AI developer behind the Daybreak program, provided more detail on how the system works. The account drew on comments from Sophos chief technology officer John Peterson.
Sophos Fusion brings together data from more than 500 third-party integrations and the company’s own security products. According to OpenAI’s case study, sensors feeding Sophos Fusion generate trillions of events daily, which Sophos reduces to roughly 1,000 to 2,000 cases for investigation across nine security operations centers.
How the agents work
For each case, an investigation agent collects information about the customer, suspicious activity and possible signs of compromise. A planning model decides which checks to run, completes them and produces a summary with recommended actions. Other agents can carry out parts of the response.
Peterson said Sophos’s earlier, mostly human-led process averaged about 38 minutes per case, compared with 89 seconds for cases handled by agents. The disclosures do not provide a case-matched comparison showing whether the two averages cover investigations of similar complexity.
What the agents may do also depends on the customer’s instructions. Under Sophos’s Notify mode, the customer acts on recommendations. Under Collaborate, Sophos and the customer work together before taking action, while Authorise allows Sophos to respond on the customer’s behalf. The company says these limits apply to humans and agents alike, and analysts handle decisions the agents are not trusted to make.
Cloudflare checks AI findings before decisions
In an engineering post, Cloudflare, a network security provider, described how its Managed Defense service checks the evidence behind AI-generated recommendations. The system uses OpenAI Daybreak and Anthropic models for deeper analysis, after initial screening using Cloudflare’s Clef model.
Cloudflare said an early prototype gave one agent an entire investigation, but the agent sometimes made claims unsupported by evidence. The company replaced that approach with software that collects evidence and sets the investigation’s boundaries before specialized agents analyze it. Application code then checks that each citation exists, belongs to the investigation and supports the specific claim it accompanies.
Cloudflare said analysts still make the final judgment. The AI investigation capability is in early beta for eligible application-security alerts and cases within Cloudflare Managed Defense.