OpenAI Daybreak

John Peterson on cutting investigation time to 89 seconds

John Peterson· CTO at Sophos
·~14 min·English·OpenAI
AI SafetyAgentsAI Company
TL;DR

Sophos CTO John Peterson explains how OpenAI Daybreak agents collapsed security-case investigation from 38 minutes to about 89 seconds, why humans still gate destructive actions, and why the fundamentals matter more than ever.

01Core Mental Model

The Defender's Window

The lead defenders hold over attackers is shrinking because the same frontier capability that helps defenders is also flowing into the open-weight models that novices can pick up.

the leading frontier models are developing more and more sophisticated cyber capabilities. those are working their way down into the openweight models as well

— John Peterson, Sophos
Key Insight
Peterson frames the threat not as a single super-attacker but as a distribution shift: when frontier cyber capability becomes cheap and open-weight, the floor rises for every attacker, so the defender's edge has to be renewed continuously rather than banked.
02The Result

Agents Cut Investigations to 89 Seconds

Daybreak-built agents cut the average case investigation from about 38 minutes to roughly 89 seconds, and now handle about half of Sophos's cases automatically.

the average response time for cases that are leveraging the agents that we've built has reduced to about 89 seconds

— John Peterson, Sophos
Key Insight
The old 38-minute number already beat 96% of professional SOCs, so the gain is not catching up to a weak baseline. It is compressing an already-strong human process by more than an order of magnitude, which changes how many cases a single analyst can oversee.
03How It Works

Plan, Execute, Review

Each case is handed to an investigation agent that feeds a planning model, runs a plan-execute-review loop, then returns a summary and recommended actions for an analyst to review.

it feeds that into a planning model which then creates a kind of plan execute um review loop and goes through it creates an investigation plan, conducts the investigation steps and then creates a summary for the analysts to review

— John Peterson, Sophos
Key Insight
The design keeps the model inside a bounded loop rather than letting it free-run: planning, acting, and reviewing are separate steps, and the investigation agent produces a summary plus recommended actions that an analyst sees. Response itself is handled by separate agents, so the speed comes from that structure, not from one model doing everything unchecked.
04The Economics

Scale the Compute, Not the Headcount

Security expertise has always been scarce, so the point of the agents is to scale compute instead of headcount and spend the analysts Sophos already has more effectively.

One of the the reasons that our MDR business has been so successful and why other MDR businesses have also been successful is because it's actually hard to find security operations analysts that have the expertise to protect customers

— John Peterson, Sophos
Key Insight
Peterson frames compute as a lever on a people problem: because security expertise is hard to hire and to staff around the clock, moving routine investigation to agents lets the experts Sophos already has cover more cases, rather than replacing their judgment.
05Trust Model

Notify, Collaborate, Authorize

Sophos runs in three modes, notify, collaborate, and authorize, that set how much response the customer lets it take, and the same rules bind agents as bind humans.

we structured it that way so that we could meet the customer where they are and align our service with their level of expertise and comfort level with us taking response on their behalf

— John Peterson, Sophos
Key Insight
The modes are about authority, not capability: Peterson stresses Sophos can operate in any of them and that the same rules apply to agents as to humans, so what changes across notify, collaborate, and authorize is how much the customer lets Sophos act, not what it is able to do.
06Human in the Loop

Humans Gate the Destructive Actions

Agents run the investigations, but anything that could be destructive in a customer environment is still passed to a human for judgment.

at least at the moment I feel like we're always going to have humans supervising anything that could be potentially destructive in a customer environment

— John Peterson, Sophos
Key Insight
Peterson draws the automation line by potential consequence, not by how the investigation went: anything that could be destructive in a customer environment is routed to a human, while less consequential response can be automated. He frames even that as true 'at least at the moment,' not a permanent rule.
07The Takeaway

Fundamentals Matter More Than Ever

In a world where even novice attackers can do real damage, doing the fundamentals well, patching, endpoint protection, MFA, segmentation, matters more than ever, not less.

it's not it's not controversial what I'm saying, I don't think, but I think we get distracted by the um the pace that the technology is moving

— John Peterson, Sophos
Key Insight
Peterson's closing cuts against the hype it rides on: he argues the very acceleration in attacker capability that makes the agents useful is the reason the fundamentals matter more, not less, and warns that the pace of the technology is what distracts teams from the basics.