Sophos says AI agents bring some cyber responses down to 89 seconds

An AI security agent that responds in under two minutes sounds useful. A customer also needs to know what it was allowed to do, and who takes over when it is uncertain.

A new OpenAI case study, published October 9, says Sophos’s AI agents have reduced average response time for the cases they handle to about 89 seconds, compared with roughly 38 minutes in its previous process. The average applies to agent-handled cases, rather than every threat Sophos encounters.

Sophos also reports that AI resolves 52% of its managed detection and response cases end-to-end. MDR is an outsourced service that investigates suspicious activity and helps organizations respond. Sophos’s existing partnership article is dated August 10 and currently contains these figures. That date does not establish when the numbers were added. The October 9 publication describes ongoing work, rather than announcing a new rollout.

What the agents actually do

The case study describes agents gathering customer context and threat intelligence, developing and executing an investigation plan, and preparing findings and recommended responses. Other agents can perform parts of the response.

For a small organization, the potential benefit is having more of this work done while its own staff are busy or unavailable. Shortening the gap between an alert and an informed decision could help defenders act sooner and leave people more time for complicated cases.

The permissions remain important. Sophos says customers can choose recommendations only, collaboration before action, or authorized direct response. Agents operate within analyst-calibrated boundaries; potentially destructive actions require human oversight.

Before choosing a service, a customer should be able to understand what can happen automatically and who is accountable if that action interrupts their work.

Three questions behind the headline

Which cases qualify? Ask whether the automated cases resemble the threats your organization faces, and how much work remains for people. The percentage alone cannot describe the difficulty of the remaining cases.

What does the clock measure? Ask when timing starts and stops, how older and newer cases were compared, and how long the slowest serious cases take. An average can hide the cases that matter most.

What happens when it is wrong? Ask for mistaken-action rates, missed threats, escalation times and a recovery process. Speed and decision quality belong in the same conversation.

The published accounts do not supply an evaluation period, sample size, error rates or independent audit for these figures. They do not establish fewer breaches. Bright has not tested the system.

Read our related report on Anthropic’s Cyber Mission and its plans to support defenders of essential services.

Follow useful AI developments with Bright Weekly: five source-checked stories and one useful thing to try, free each week.