OpenAI published a customer story about Sophos on October 9, 2026, and its headline number is a fall from about 38 minutes to 89 seconds on the cases where Sophos runs agents built on OpenAI Daybreak. Sophos is a security vendor that protects more than 625,000 organizations, and the page presents the result as its own, with quotes from its chief technology officer, John Peterson. It is a supplier’s account of a customer’s results, not a measurement anyone outside the two companies has checked.
What was actually released
The story does not announce a new OpenAI product. Daybreak is the program Sophos used, and the page describes how Sophos wired it into Sophos Fusion, its AI-native cyber defense system, which includes Sophos Managed Detection and Response. The work runs on sensor data from more than 500 third-party integrations alongside Sophos’s own products. Sophos says those sensors produce trillions of events a day, which it distills into roughly 1,000 to 2,000 cases for its nine security operations centers.
On each case, an investigation agent pulls the customer context, the detections, the indicators of compromise, and the relevant threat intelligence. A planning model then runs a loop the page describes as plan, execute, and review: it builds an investigation plan, completes the steps, and writes a summary with recommended response actions for an analyst to review. Other agents can carry out parts of the response itself.
What is actually new for a buyer
- The unit of work is a case, not a prompt: these numbers are case-level, taken from one supplier’s own pipeline, and nothing published lets an outsider rebuild them.
- Human oversight is a product feature here, not a footnote: Sophos names three modes, Notify, Collaborate, and Authorize, and says the same boundaries apply whether a person or an agent does the work.
- The rollout is a customer’s, not a general release: the page carries no price, no plan, and no date for Daybreak itself.
What the claim rests on
Every number on the page is stated by Sophos or by OpenAI, and none of them is audited. The page gives four, and the format is a customer story, which is marketing with a case study’s clothes.
| Figure as published | What it covers | Independent check |
|---|---|---|
| 89 seconds average response time | cases handled with agents built on Daybreak | none published |
| 96% reduction in investigation time | against a baseline Sophos gives as about 38 minutes | none published |
| 52% of MDR cases resolved end to end by AI | Sophos’s own service, within boundaries set by its analysts | none published |
| More than 625,000 organizations protected | Sophos’s customer count, its own figure | none published |
The 96% is arithmetic on two numbers Sophos supplies, a baseline of about 38 minutes and a result of 89 seconds. It is the customer’s own before and after, with no stated sample, no period, and no definition of what an investigation is. The same page also says the 38-minute baseline was better than 96% of professional security operations centers, a second 96% that measures something else entirely and is easy to fold into the first one in a headline.
What is not published
There is no price for OpenAI Daybreak, no plan list, no availability date, and no region list. The page gives no sample size, no time period, and no definition of the cases behind the 89 seconds; nothing says whether the average is a mean or a median, or how many of the cases still ended with a person making the call. Sophos’s 625,000-organizations figure and its 96%-of-SOCs comparison are the vendor’s own, with no third party named and no method shown.
On this page
What it changes for security teams buying AI agents
For a team that already pays for detection and response, the interesting claim is not the 96% but the boundary: the same rules apply whether a person or an agent acts. Sophos sells that as three modes, so a buyer can decide whether the agent recommends, works alongside an analyst, or responds alone. That is the decision variable, and it is a governance question before it is a model question.
Procurement is the second change. This is an enterprise program sold through contact sales, not a self-serve tool with a price on a page, so the cost sits on the vendor’s side of the table and the comparison a smaller team can make is limited. What a team can ask for is the same thing the page withholds: the sample, the period, and the definition behind the headline.
The Neural Minute take
None of the tools we document is OpenAI Daybreak, so there is no verified price of ours to hold this claim against. That is worth saying plainly, and it is the position we took on Google’s Gemini agent and on Oracle’s ChatGPT and Codex rollout: three customer stories in a week, each carrying the supplier’s numbers and the customer’s name.
A supplier publishing a customer’s before and after is not evidence that the numbers are wrong. It is evidence that the numbers are the supplier’s, and that nobody outside the two companies has counted.
What we can compare is the shape of the purchase. Where our own readings cover the low end of agent tooling, the model is a meter rather than a seat: Context.dev bills $19 a month for 7,500 credits, and Agentik adds a fee on top-ups instead of charging per seat, both read on the companies’ own pages. Enterprise security runs the other way, on negotiated contracts, and the day of a vendor’s best customer story is not the day its economics become visible. A buyer comparing the two should read the case study as a starting point for questions, not as a price.
That is the test to keep for the next story of this kind. Ask for the sample, the period, and the definition, and treat the headline percentage as the customer’s own until someone outside the two companies can reproduce it.
Sources
- Sophos cuts threat investigation time by 96% with OpenAI Daybreak, OpenAI, published October 9, 2026: https://openai.com/index/sophos
- The 89-second average, the 96% reduction, the 52% end-to-end figure, the 38-minute baseline, the 625,000-organizations count, and the Notify, Collaborate, and Authorize modes are read on that page on October 9, 2026, and reproduced as Sophos’s and OpenAI’s own statements, not as independent measurements
- Prices for Context.dev and Agentik come from our own verified readings, not from any third party