Sophos Cut Security Investigation Time by 96% with OpenAI's Daybreak
In its MDR service, which hunts for and responds to security threats on customers' behalf, Sophos says AI handled 52% of cases end to end. Humans still supervise any action that could cause damage.
Sophos said on October 9 local time that it had cut the time needed to investigate security threats by 96% using OpenAI’s Daybreak. OpenAI published the case study the same day. Sophos said that in its MDR (managed detection and response) service, which finds and responds to security threats on a customer’s behalf, AI resolved 52% of cases from start to finish. The result comes from putting AI that handles work on its own, known as agents, into the investigation and response tasks that security staff used to do.
How much faster are investigations?
The change Sophos highlights is the time it takes to work through a single case. For cases handled with agents, average response time fell from about 38 minutes to 89 seconds. Sophos applied AI to gathering the material needed to investigate a threat and summarizing response options. According to Sophos, that extends to drafting the recommendations an analyst reviews.
The volume of data involved is substantial. Sophos says it protects more than 625,000 organizations and pulls in data from more than 500 integrations with other companies’ products. Out of the trillions of security records that pile up each day, it narrows the list down to 1,000 to 2,000 cases that actually warrant investigation. AI takes part in investigating and responding to those filtered cases.
How far does the AI go?
At the center of the work sits Sophos Fusion, a security platform that includes MDR. Agents built with Daybreak collect customer information and detection results for each case. They also gather indicators of compromise and threat intelligence. Their role is to have ready the material a security analyst needs in order to judge a case.
Once the material is assembled, the next step is setting the order of the investigation. A model responsible for planning builds out the investigative procedure and writes the response recommendations an analyst will review. Other agents can directly carry out part of the response work. The scope of use Sophos described ranges from organizing material and drafting response recommendations to carrying out some response actions.
Who decides how much authority the AI has?
The customer does. Customers can choose from three ways of responding to a security incident: take action themselves, respond in consultation with Sophos, or hand response authority over to Sophos. The actions AI is allowed to execute also stay within the limits the customer has set.
The same scope of authority applies to people and agents alike. Sophos said that human supervision is required for any action that could cause damage. Cases judged unsuitable to leave to an agent are passed to a person. Even when AI handles a case all the way through, it follows the limits the customer has set.
In the end, this is a setup in which AI prepares in advance the material and response options a security staffer will look at, and also carries out some response actions within permitted limits. The questions to watch from here are which types of cases produce the same effect, and how the process for having humans review risky responses actually works in practice.