Sophos, which protects over 625,000 organizations worldwide, has deployed AI agents built with OpenAI's technology to investigate cyber threats. These AI agents gather information about attacks, create investigation plans and recommend responses—tasks that previously took an average of 38 minutes per case. With AI assistance, the same work now takes about 89 seconds, a 96% reduction in time.
The AI agents handle about half of Sophos's security cases end-to-end, but within strict limits. Customers choose one of three modes: Sophos can notify them of threats, collaborate on decisions, or respond directly—and these same controls apply whether humans or AI agents do the work. Sophos's security analysts still review recommendations before any major actions are taken.
Why it matters
- Schools and businesses can respond faster to cyber attacks, reducing potential damage and data loss risks.
- Security teams can focus on complex, unusual threats instead of routine work, improving overall protection quality.
- Organizations maintain human control over security decisions, so AI assists rather than replaces human judgment.
What to do
- Review your organization's current cybersecurity incident response times and processes.
- Ask your security provider about AI-assisted threat detection if you haven't already.
- Ensure any AI security tool you adopt includes human oversight and customer control settings.