Sophos Fusion Turns AI-Native Defense into a Controlled Response System
Sophos Fusion combines AI agents, threat intelligence, security operations, and customer-defined controls to shorten cyber defense investigations from minutes to seconds. The system matters because it connects large-scale detection with a response process that still distinguishes routine automation from actions requiring human oversight.
Sophos Fusion combines AI agents, threat intelligence, security operations, and customer-defined controls to shorten cyber defense investigations from minutes to seconds. The system matters because it connects large-scale detection with a response process that still distinguishes routine automation from actions requiring human oversight.
Sophos Fusion makes investigation speed a system capability
Sophos has operated in cybersecurity for four decades and protects more than 625,000 organisations. Its security platform processes trillions of events each day, drawing sensor data from more than 500 third-party integrations. That volume is reduced to roughly 1,000 to 2,000 investigation cases, creating the operational problem Sophos Fusion is designed to address: deciding which cases require attention and moving from detection to response without making analysts work through every step manually. Sophos Fusion is an AI-native cyber defense system that includes Sophos Managed Detection and Response, and its scale provides the foundation for measuring whether AI changes the workflow rather than simply adding another interface.
Daybreak connects evidence, planning, and execution
OpenAI Daybreak combines OpenAI models with Sophos threat intelligence, response playbooks, and security expertise. Its investigation agent gathers customer context, detections, indicators of compromise, and relevant threat intelligence before the planning model applies a plan-execute-review loop to the investigation. This gives the system a defined operating sequence: collect the evidence, plan the work, execute the investigation, and review the result. The performance difference is substantial. Before Daybreak, Sophos cases averaged approximately 38 minutes in response time; cases using Daybreak agents average about 89 seconds. About half of Sophos cases are automated by Daybreak agents, and Sophos reports that AI resolved 52% of MDR cases end-to-end within boundaries calibrated by analysts. Those figures point to a practical division of labour, but speed alone does not determine whether an automated defense system is usable.
Customer control determines how far automation can act
Sophos provides three operating modes for customer control: Notify, Collaborate, and Authorise. These modes let an organisation choose how the system communicates and participates in response workflows. Sophos requires human oversight for potentially destructive actions, while the reported end-to-end AI resolutions occurred within boundaries calibrated by analysts. The result is not an unrestricted autonomous system; it is a controlled operating model in which the degree of automation can reflect the consequences of the action. Organisations evaluating Sophos Fusion can begin with a concrete implementation step by reviewing which of their existing security sensors match the available third-party integrations, then defining where Notify, Collaborate, or Authorise fits each response workflow. That assessment turns the product from a general AI claim into an operational decision about evidence, permissions, and escalation.
The practical test is whether faster response preserves layered defense
Sophos operates nine security operations centres and plans to expand its agents' response capabilities and use cases, so Fusion is positioned as an evolving layer within a broader security program rather than a replacement for basic controls. Sophos recommends maintaining layered fundamentals that include patching, endpoint protection, multifactor authentication, network segmentation, and security operations. For a security team, the practical implication is clear: evaluate Fusion by the cases it can investigate quickly, the integrations it can use, the operating mode appropriate to each workflow, and the actions that still require human oversight. AI can compress the path from a security event to a reviewed response, but the quality of that path depends on the surrounding controls and on boundaries defined for the organisation's own environment.
Specs
- Protected organisations: More than 625,000
- Third-party integrations: More than 500
- Daily security events: Trillions
- Daily investigation cases: Approximately 1,000 to 2,000
- Security operations centres: 9
- Pre-Daybreak average response time: Approximately 38 minutes
- Daybreak-agent average response time: About 89 seconds
- MDR cases resolved end-to-end with AI: 52%