An agent that summarizes an alert and an agent that closes a security case deliver different products. The second can remove work from an analyst queue, but it also needs a defensible answer to a harder question: which evidence permits which action? Sophos's Daybreak case study is useful because it links reported speed to operational responsibility, while leaving important reliability questions open.
Sophos reports about 89 seconds for investigation and response on agent-handled cases, compared with a previous average near 38 minutes, and says AI resolves 52 percent of managed detection and response cases end to end. These are company-reported figures, not proof that every customer incident closes in 89 seconds. The same response and closure numbers appeared in Sophos's May 2026 announcement; October's OpenAI account adds deployment detail rather than establishing an entirely new measurement.
Fix the unit of work
Ask where the timer starts: raw alert, correlated case, agent activation or analyst validation. Also ask where it ends. Containing one compromised endpoint is not necessarily complete remediation, restoration or removal of every access path. A speed comparison is useful only when its start, stopping condition and eligible case categories stay consistent.
Sophos's agents work after telemetry has already been filtered and correlated, not independently across every raw event. The system assembles customer context, detections, indicators and threat intelligence, then follows a plan, execute and review loop. Reliable telemetry and mature playbooks are part of the result; a typical internal security team cannot assume it inherits those operating conditions by buying the same model.
Map customer permission to agent action
Sophos describes three response modes. In Notify, it investigates and recommends while the customer acts. Collaborate involves joint action decisions. Authorise permits Sophos to respond within agreed boundaries. These rules apply whether a person or agent performs the work: a quick verdict must not silently expand a customer's authorization.
Require an action matrix covering reversibility, business impact, data access and mandatory escalation. Known repeatable cases can run under supervision without approval at every step; novel patterns, high-stakes choices and missing business context need direct human involvement. The remaining 48 percent is not automatically automation failure: it can include the difficult cases where expert judgment belongs.
Pair closure rates with correction rates
Neither the reported 96 percent time reduction nor 52 percent closure discloses false positives, missed threats, reopened cases, customer reversals or analyst corrections. Request those measures by case category, not only as an aggregate. A lower automation share may reflect stricter safety thresholds or a more difficult workload rather than an inferior product.
Sample automatically closed cases and test adversarial evidence, incomplete telemetry and legitimate administrative activity that resembles an attack. Model-generated findings need validated support before consequential action. A reviewer must have enough time, evidence and authority to stop a response; merely placing a human somewhere in the process does not prevent habitual approval or automation bias.
Pilot bounded outcomes before expanding authority
Choose high-volume cases with clear evidence, reversible responses and mature escalation rules. Compare total analyst effort, detection quality, unwanted disruption, reopening and recovery against the existing process. Retain the evidence, tool actions, decision ownership and customer authorization needed to reconstruct each case after the agent has finished.
Review data-processing location, retention, model-component access and third-party telemetry contracts as well as performance. Expand use cases only with corresponding evaluation, rollback and accountable approval. The useful purchasing standard is not the highest autonomous closure percentage. It is appropriate closure at a defined risk level, with measurable errors and a clear owner when the automated response is wrong.