Sophos and OpenAI Secure Cyber Defenses

Sophos is recognized as one of the world's largest cybersecurity companies, serving approximately 650,000 customers globally across every market sector.

The company possesses over four decades of experience in combating a diverse range of cyber threats, continuously adapting its strategies to evolving attack landscapes.

Frontier models are developing increasingly sophisticated cyberattack capabilities, which are filtering down into open-weight models and driving faster exploitation paths.

This trend has led to a massive surge in vulnerabilities, as reflected in the growing number of CVEs, prompting Sophos to utilize programs like Daybreak to gain frontier intelligence and maintain a protective edge.

Sophos contributes deep domain expertise, including extensive threat intelligence and proven response playbooks, essential for combating cyberattacks at scale.

Through programs like Daybreak, OpenAI provides frontier intelligence that empowers Sophos to enhance its existing knowledge and extend its defensive capabilities to protect all 650,000 customers more effectively.

The Sophos Fusion system is the core platform powering the company's managed detection and response (MDR) service, as well as its EDR and XDR products, by integrating sensor data from over 500 third-party and native security products.

This system processes trillions of daily events, filtering them down to a manageable 1,000 to 2,000 critical security cases each day, which are then managed by nine security operations centers for customers.

Sophos historically relied heavily on human expertise for threat investigations, achieving an average response time of 38 minutes 18 months ago, a performance better than 96% of professional security operations centers at the time.

However, with the implementation of AI agents developed through the Daybreak program, the average response time for cases leveraging these agents has dramatically reduced to just 89 seconds, with roughly 50% of cases now automated.

The investigation agent developed by Sophos processes all relevant case information, including customer context, detections, and knowledge of the current threat landscape.

This data is fed into a planning model that creates a 'plan-execute-review' loop, allowing the agent to perform investigation steps and generate summaries and recommended actions for human analysts, while automated response agents handle specific, consistent actions.

The cybersecurity industry faces a chronic global shortage of skilled expertise, making it challenging for organizations to maintain robust defenses.

Sophos addresses this by leveraging automation to scale 'compute' capabilities rather than constantly needing to increase headcount, thereby utilizing existing security analysts more effectively and efficiently to maintain 24/7 response capabilities without the usual staffing burden.

To navigate the complexities of trust and judgment in human- and agent-driven responses, Sophos structures its Managed Detection and Response business around Notify, Collaborate, and Authorize operating modes.

The Notify mode provides full investigation guidance without independent action, Collaborate mode involves joint decision-making with customers, and Authorize mode grants the Security Operations Center full empowerment to take immediate response actions on behalf of the client.

To automate investigations and boost analyst efficiency, Sophos leverages agent technology while reserving critical decision-making for human operators, according to the company.

The system is designed to align with customers' specific comfort levels regarding automation, ensuring they retain control over authorization while being protected.

Sophos anticipates that its response capabilities will become increasingly sophisticated over time, allowing AI agents to address a wider array of cybersecurity use cases.

Despite this evolution, human supervision will remain in place for any tasks that carry the potential for destructive impact within a customer's environment, reinforcing the core mission of keeping customers protected and operational.

In an environment where the 'defender window' is closing and 'Frontier Intelligence' is rapidly accelerating, even novice attackers are capable of inflicting significant damage.

This reality makes executing fundamental cybersecurity practices, such as robust patching programs, solid endpoint protection, multi-factor authentication (MFA), and effective network segmentation, more critical than ever, supported by a strong security operations program.

The defender window is narrowing as attacker capabilities grow, fueled by accelerating Frontier Intelligence, which empowers even novice attackers to make a greater impact.

Effective patching programs for vulnerabilities, robust endpoint protection, and comprehensive MFA implementation across identity infrastructure are therefore critical priorities, alongside strong network segmentation and integrated security operations to support these basic defenses.

Industry professionals frequently find themselves distracted by the rapid pace of technological advancements, potentially at the expense of core security operations.

Sophos advocates for leveraging AI agents to assist security operations teams with increasing workloads, while emphasizing that advanced tools do not diminish the necessity of foundational security practices, a point that, despite its importance, is not controversial.