Sophos Cuts Cyber Probe Times to 89 Seconds With OpenAI Agents

Building the partner ecosystem with Sophos — OpenAI

OpenAI

While autonomous models now resolve half of all investigations, human supervision remains mandatory for disruptive remediation to prevent AI from causing operational outages.

AI-assisted summary of Building the partner ecosystem with Sophos — original source. Check the original for full context.

Source published:

Key ideas

  • Sophos integrated OpenAI's Daybreak frontier intelligence into its Sophos Fusion platform, slashing SOC investigation times from an industry-leading 38-minute benchmark down to approximately 89 seconds. (3:44)
  • Autonomous Daybreak-powered agents now handle approximately 50% of the 1,000 to 2,000 high-priority security cases distilled daily from trillions of telemetry events across 500+ integrations. (3:44)
  • To govern automated response without risking production outages, Sophos enforces three operating tiers (Notify, Collaborate, Authorize) and mandates strict human-in-the-loop sign-off for any potentially destructive action. (6:57)
  • As frontier model capabilities trickle down into open-weight tools and empower novice attackers, Sophos cautions that foundational security hygiene—patch management, endpoint security, universal MFA, and network segmentation—is more vital than ever. (11:08)

Detailed notes

## Background Published on YouTube by OpenAI on September 29, 2026, this session features Claire Lawlor, Digital Native AD EMEA at OpenAI, in conversation with John Peterson, CTO at Sophos. The video explores the critical role of strategic technology partnerships in safeguarding organizations against accelerating cyber threats.

## TL;DR Sophos CTO John Peterson outlines how Sophos integrates OpenAI's Daybreak program to counter the narrowing defender's window in an era of rapid AI advancement. By deploying autonomous investigation agents within the Sophos Fusion platform, the company slashed median investigation times from an industry-leading 38 minutes down to roughly 89 seconds across half of its incoming security cases. Despite these dramatic speed gains across a customer base of 650,000 organizations, Peterson emphasizes that strict human-in-the-loop governance remains essential for destructive remediation decisions. Ultimately, he stresses that cutting-edge AI automation must complement, rather than substitute for, foundational cybersecurity practices like continuous patching, endpoint defense, MFA, and network segmentation.

## Atmosphere & style The presentation carries the warm, collegial tone of an executive fireside chat, punctuated by lighthearted banter regarding the post-lunch conference slump and Peterson's cross-country red-eye travel. Lawlor provides an empathetic and conversational sounding board, encouraging Peterson as he candidly navigates jet lag to deliver sharp architectural insights. Despite the urgent context of accelerating cyber warfare and automated threat vectors, the mood remains pragmatic and reassuring, grounded in strict operational guardrails and common-sense defensive fundamentals before winding down toward an informal open bar reception.

## Bulletin - [03:44](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=224s) Sophos integrated OpenAI's Daybreak frontier intelligence into its Sophos Fusion platform, slashing SOC investigation times from an industry-leading 38-minute benchmark down to approximately 89 seconds. - [03:44](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=224s) Autonomous Daybreak-powered agents now handle approximately 50% of the 1,000 to 2,000 high-priority security cases distilled daily from trillions of telemetry events across 500+ integrations. - [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) To govern automated response without risking production outages, Sophos enforces three operating tiers (Notify, Collaborate, Authorize) and mandates strict human-in-the-loop sign-off for any potentially destructive action. - [11:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=668s) As frontier model capabilities trickle down into open-weight tools and empower novice attackers, Sophos cautions that foundational security hygiene—patch management, endpoint security, universal MFA, and network segmentation—is more vital than ever.

## Key takeaways - [00:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=8s) The defender's window is narrowing rapidly as frontier intelligence advancements quickly propagate to open-weight models, driving a surge in CVE exploitation velocity. - [00:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=8s) With 40 years of experience and 650,000 customers worldwide, Sophos leverages OpenAI's Daybreak program to protect both its vast customer footprint and its own high-profile infrastructure. - [02:30](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=150s) Defending modern enterprise workloads requires marrying deep proprietary domain expertise—threat telemetry, playbooks, and practitioner know-how—with frontier AI reasoning to scale protection globally. - [03:44](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=224s) The Sophos Fusion platform ingests trillions of daily events across 500+ security integrations, distilling them into 1,000 to 2,000 high-priority cases investigated daily across nine global SOCs. - [03:44](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=224s) Daybreak-powered investigation agents leverage a cyclical plan-execute-review loop to evaluate detections, IOCs, and environment context, generating structured summaries and remediation recommendations. - [03:44](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=224s) Investigation times dropped from an average of 38 minutes under human analysts to roughly 89 seconds with autonomous agents, which now process roughly half of all inbound cases. - [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) Autonomous security agents solve the chronic cybersecurity talent shortage by scaling compute resources rather than headcount, liberating human analysts to handle high-stakes threats. - [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) Sophos aligns AI response actions to customer risk tolerance using three MDR tiers: Notify (advisory only), Collaborate (co-managed response), and Authorize (autonomous proactive remediation). - [10:06](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=606s) Operational stability remains paramount; potentially destructive response actions—such as isolating critical infrastructure—strictly require human oversight and sign-off. - [11:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=668s) Security leaders must avoid being distracted by AI tooling at the expense of non-negotiable fundamentals: rigorous patch management, endpoint protection, universal MFA, and network segmentation. - [11:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=668s) AI agents are designed to wrap around and scale foundational cybersecurity practices rather than replace baseline hygiene.

## Detailed walkthrough ### [00:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=8s) Introduction to Sophos and the Narrowing Defender's Window

Claire Lawlor opens the session with a warm welcome and a lighthearted nod to the dreaded "post-lunch slump," pointing out that John "JP" Peterson has the best possible excuse to feel tired after an intense travel schedule that took him from the US East Coast to the West Coast and finally into London the night before. Introducing himself, Peterson explains his role as Chief Technology Officer at Sophos, one of the world's largest cybersecurity providers. Over four decades in the industry, Sophos has built a massive global footprint supporting approximately 650,000 customers spanning virtually every market segment and sector, providing the company with an expansive vantage point across an extraordinary variety of cyber threats.

```mermaid flowchart TD accTitle: Threat Landscape and Defender Advantage accDescr: Diagram illustrating how frontier intelligence advances vulnerability exploitation and how the Daybreak partnership counters it.

subgraph ThreatDynamics ["Threat Landscape Acceleration"] FIM["Advancing Frontier Models"] --> OWM["Open-Weight Model Capabilities"] OWM --> EXP["Accelerated Exploitation & Rising CVEs"] end

subgraph DefenderResponse ["Defender Strategy"] EXP --> DEF["Narrowing Defender's Window"] DBP["OpenAI Daybreak Program"] --> ADV["Frontier Intelligence Integration"] ADV --> PROT["Proactive Protection for 650K+ Customers"] end

DEF -.-> DBP ```

Turning to the core theme of the day, Lawlor asks Peterson to unpack the concept of the "narrowing defender's window" in the context of Sophos and its participation in OpenAI's Daybreak program. Peterson explains that this window is defined by the rapid pace of acceleration in frontier intelligence. As frontier models gain increasingly sophisticated cyber capabilities, those same capabilities quickly trickle down into open-weight models, accelerating vulnerability exploitation paths and driving a massive surge in Common Vulnerabilities and Exposures (CVEs). For Sophos, which represents both a high-profile target as a major security firm and the protector of 650,000 customer organizations, the Daybreak program represents an essential opportunity to leverage frontier intelligence to stay a step ahead of malicious actors.

- **Customer reach**: Approximately 650,000 customers worldwide across diverse industry verticals. - **Industry longevity**: Over 40 years of accumulated cybersecurity domain expertise. - **Threat acceleration**: Rising CVE volumes and rapid weaponization driven by advancing frontier and open-weight models.

---

[02:30](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=150s) Combining Domain Expertise with Frontier Intelligence

Addressing how the broader security ecosystem collaborates, Lawlor asks how OpenAI, Sophos, and end customers collectively make protection work. Peterson frames the relationship as a complementary union between deep cybersecurity domain knowledge and cutting-edge artificial intelligence. Over decades of defending organizations, Sophos has amassed immense operational assets, including rich threat intelligence repositories, battle-tested incident response playbooks, and specialized human practitioner know-how.

Peterson highlights that domain expertise alone cannot easily scale to match the sheer volume and velocity of modern attacks. By partnering with OpenAI and integrating Daybreak's frontier intelligence, Sophos is able to operationalize and scale its accumulated playbooks and threat insights across its entire global customer base. Lawlor remarks on the momentum of the partnership, noting how rapidly it has grown from strength to strength.

- **Sophos contribution**: Proprietary threat intelligence, response playbooks, operational telemetry, and human domain experts. - **OpenAI contribution**: Frontier intelligence and reasoning capabilities via programs like Daybreak to scale human expertise across enterprise workloads.

---

[03:44](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=224s) Architecture and Impact: From 38 Minutes to 89 Seconds

Moving to concrete technical implementations, Peterson details how Daybreak-powered autonomous agents operate within the Sophos Fusion platform—the underlying engine powering Sophos Managed Detection and Response (MDR) as well as its Extended Detection and Response (EDR/XDR) product suite. The system ingests telemetry across more than 500 integrations spanning both third-party security tools and native Sophos sensors. These sensors generate trillions of raw telemetry events every day, which the platform aggregates and distills down to roughly 1,000 to 2,000 high-priority cases investigated daily across nine Security Operations Centers (SOCs).

```mermaid flowchart LR accTitle: Sophos Fusion AI Investigation Pipeline accDescr: Workflow showing telemetry ingestion from 500+ integrations distilled to cases processed by an agentic plan-execute-review loop down to analyst review.

subgraph Ingestion ["Telemetry & Distillation"] SENS["500+ Integrations & Sensors"] --> EVT["Trillions of Daily Events"] EVT --> CASES["1,000 - 2,000 Cases / Day"] end

subgraph AgentLoop ["Daybreak Investigation Agent"] CASES --> PLAN["Planning Model"] PLAN --> LOOP["Plan-Execute-Review Loop\n• Context & Detections\n• Threat Intel & IOCs"] LOOP --> SUM["Investigation Summary &\nRecommended Response"] end

subgraph Execution ["Resolution"] SUM --> SOC["9 Global SOC Analysts"] SUM --> AUTO["Automated Response Agents"] end ```

In what Peterson jokingly refers to as the "before time" roughly 18 months prior, investigations were driven almost entirely by human analysts. Sophos maintained an average investigation time of approximately 38 minutes—a benchmark that outperformed 96% of professional SOCs worldwide. With the deployment of Daybreak-powered investigation agents, that investigation time plummeted to roughly 89 seconds for agent-handled cases. Currently, about half of all incoming cases are automated by these models. The investigation agent ingests the complete context of a case—including telemetry detections, indicators of compromise (IOCs), customer environmental factors, and threat landscape data—and feeds it into a planning model. This model executes a cyclical "plan-execute-review loop," performs required forensic steps, produces a structured investigation summary, and drafts concrete remediation actions for analysts or automated response agents.

- **Telemetry scale**: Trillions of events daily from over 500 security integrations distilled into 1,000–2,000 actionable cases per day across 9 global SOCs. - **Investigation speed transformation**: Reduced from an industry-leading 38-minute human baseline to approximately 89 seconds with AI agents. - **Automation penetration**: Approximately 50% of all incoming SOC cases are now handled by autonomous Daybreak investigation agents.

---

[06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) Scaling Talent and Managing Risk with Operating Modes

When asked how Sophos reallocates the significant time and labor saved by slashing investigation times, Peterson explains that the core bottleneck in the industry has always been a chronic deficit of skilled cybersecurity talent. Staffing a 24/7 internal SOC with top-tier talent is notoriously difficult and cost-prohibitive for most organizations. AI automation allows Sophos to scale compute resources rather than headcount, freeing experienced human analysts from routine investigations to focus on complex, high-stakes threats while maximizing operational efficiency.

Lawlor notes that while threat identification is difficult, deciding how and when to remediate requires critical judgment and trust. Peterson explains that Sophos applies the exact same governance framework to AI agents as it has traditionally applied to human analysts through three distinct MDR operating tiers:

| Operating Mode | Investigation Responsibility | Response & Action Authority | |:--- |:--- |:--- | | **Notify** | Fully conducted by Sophos SOC / Agent | Sophos provides guidance and recommended actions; never takes independent remediation action. | | **Collaborate** | Fully conducted by Sophos SOC / Agent | Sophos works side-by-side with the customer; actions are executed only with direct customer involvement. | | **Authorize** | Fully conducted by Sophos SOC / Agent | Sophos is fully empowered to immediately execute proactive containment and remediation actions on behalf of the customer. |

These distinct modes enable customers to align Sophos's automation and human capabilities with their internal comfort level, risk tolerance, and technical maturity. Peterson emphasizes that while speed and automation are paramount, human oversight remains non-negotiable whenever potentially destructive remediation actions—such as isolating critical infrastructure or terminating sensitive services—are on the table, ensuring agents automatically escalate critical decisions for human verification.

[10:06](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=606s) Human Supervision and Preserving Customer Control in Automated Response

Even as autonomous AI agents shoulder a massive share of the investigative workload, John Peterson emphasizes that human judgment remains non-negotiable when it comes to remediation and response. After sharing a brief, candid moment of fatigue from the previous evening—drawing warm reassurance from Claire Lawlor that he was doing great—Peterson outlines how he envisions this dynamic progressing. In his view, response capabilities will steadily grow in technical sophistication, and Sophos will broaden the array of complex use cases their agents can tackle. However, when an action poses any potential to disrupt or damage a production environment, Peterson insists that a human must remain in the supervisory loop. At its core, Sophos’s overarching priority—"mission one"—is ensuring customers stay both fully protected and continuously operational.

Lawlor notes that this philosophy centers on customer agency: organizations must be empowered to calibrate their own operational risk tolerances, choosing whether agents possess full authorization to act autonomously or are restricted to notification-only alerts requiring explicit sign-off. Peterson confirms that maintaining this clear boundary ensures security automation accelerates incident handling without ever jeopardizing operational stability.

```mermaid flowchart TD accTitle: Incident Response Workflow with Human Oversight accDescr: Diagram illustrating agent automation handing off to human supervision before taking destructive action.

subgraph Investigation["Agent Investigation Layer"] A["Threat Telemetry & Signals"] --> B["AI Investigation Agents"] B --> C["Automated Context & Analysis"] end

subgraph ActionBoundary["Operational Safeguards"] C --> D{"Potentially Destructive Action?"} D -- "Non-Destructive / Safe" --> E["Automated Remediation"] D -- "Destructive / High Impact" --> F["Human Supervisor Review"] end

subgraph Execution["Customer Control Modes"] F --> G["Full Authorization Mode"] F --> H["Notification-Only Mode"] G --> I["Controlled Incident Resolution"] H --> I end ```

- **Core Operational Mandate**: Protect systems without causing operational downtime or self-inflicted outages. - **Supervisory Boundary**: Absolute human oversight is required for any system action that is potentially destructive. - **Customer Governance**: Organizations retain the choice to grant autonomous execution privileges or enforce notification-only gating.

---

[11:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=668s) The Non-Negotiable Fundamentals in an Era of Accelerated Frontier AI

Shifting the conversation toward practical advice for security leaders, Lawlor asks what initial steps organizations should take when partnering with Sophos. Peterson explains that the broader security landscape is experiencing an intense squeeze: the defender window is rapidly closing, frontier AI intelligence is accelerating, and relatively novice attackers can now inflict significant real-world damage with minimal effort. In such a high-velocity threat environment, Peterson argues that executing core cybersecurity hygiene and fundamentals is more urgent and critical than ever before. Rather than replacing the basics, modern AI threats raise the bar on foundational defense.

```mermaid flowchart LR accTitle: Foundational Cybersecurity Defense Layers accDescr: Flow diagram showing fundamental cybersecurity pillars wrapped by security operations.

subgraph Fundamentals["Defensive Pillars"] A["CVE Vulnerability & Patch Management"] B["Top-Tier Endpoint Protection"] C["Ubiquitous MFA on Identity"] D["Rigorous Network Segmentation"] end

Fundamentals --> E["SecOps Wrapping Layer<br/>(AI Agents + Human Expertise)"] ```

Peterson cautions that security teams often get dazzled or distracted by the blistering pace of emerging AI technologies. While Sophos aggressively leverages agents to help overburdened Security Operations (SecOps) teams process mounting alert volumes, technology cannot compensate for neglected groundwork. Organizations must maintain rigorous patch management programs to remediate CVEs published across vendor software and open-source packages, deploy best-in-class endpoint protection, enforce multi-factor authentication (MFA) across all identity infrastructure, and establish tight network segmentation. A mature security operations framework must wrap around all these pieces to provide holistic resilience.

Closing out the session, Lawlor thanks Peterson and encourages attendees to connect with him over drinks at the upcoming open bar to pick his brain on security strategy. She then concludes her hosting duties by introducing the next speaker, Tom Duff Gordon, OpenAI's Policy VP for EMEA.

- **Closing Defender Advantage**: Novice cyber adversaries are achieving outsized attack capability due to accelerated frontier intelligence. - **Essential Security Hygiene Pillars**: - Continuous vulnerability management and proactive patching across third-party and open-source software. - Deployment of top-tier, robust endpoint protection. - Universal multi-factor authentication (MFA) across the entire identity layer. - Strict internal network segmentation to halt lateral threat propagation. - Comprehensive security operations programs enhanced by AI agents to absorb operational workload.

## Notable quotes > [00:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=8s) narrowing defender's window — Claire Lawlor

> [03:44](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=224s) before time — John Peterson

> [03:44](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=224s) plan-execute-review loop — John Peterson

> [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) Notify — John Peterson

> [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) Collaborate — John Peterson

> [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) Authorize — John Peterson

> [10:06](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=606s) mission one — John Peterson

## Mentioned Claire Lawlor, John "JP" Peterson, Tom Duff Gordon, OpenAI, Sophos, Sophos Fusion, Sophos Managed Detection and Response (MDR), Sophos Extended Detection and Response (EDR/XDR), OpenAI Daybreak program

## Video description Claire Lawlor, Digital Native AD EMEA at OpenAI, and John Peterson, CTO at Sophos, explain the role of technology partnerships in keeping organizations safe from cyber threats

[Source](https://www.youtube.com/watch?v=zoohZ1BiHs0)

中文简报

Sophos利用OpenAI智能体将网络调查时间缩短至89秒 尽管自主模型目前已能处理半数调查，但破坏性修复仍强制要求人工监督以防引发业务中断。 Sophos首席技术官John Peterson阐述了Sophos如何整合OpenAI的Daybreak项目，以应对AI快速发展时代防御方响应窗口不断收窄的挑战。通过在Sophos Fusion平台中部署自主调查智能体，该公司在其半数待处理安全事件中，将调查时间中位数从行业领先的38分钟大幅压缩至约89秒。尽管在覆盖65万家机构的客户群体中实现了如此显著的速度提升，Peterson仍强调，对于破坏性修复决策，严格的人机协同治理依然不可或缺。最终，他强调前沿AI自动化必须作为持续修补、端点防御、MFA和网络分段等基础网络安全实践的补充，而不能取而代之。 Sophos将OpenAI的Daybreak前沿智能整合至Sophos Fusion平台，将SOC调查时间从行业领先的38分钟基准缩短至约89秒。 (3:44) 基于Daybreak的自主智能体目前负责处理每日从500多个集成系统的数万亿遥测事件中提炼出的1,000至2,000起高优先级安全事件中的约50%。 (3:44) 为在管控自动化响应的同时避免造成生产中断风险，Sophos设立了三个运行层级（通知、协作、授权），并对任何潜在的破坏性操作强制执行严格的人工介入审批。 (6:57) 随着前沿模型能力渗透至开放权重工具并赋能新手攻击者，Sophos提醒，补丁管理、端点安全、全面部署MFA和网络分段等基础安全规范比以往任何时候都更加关键。 (11:08)

Reading summary

Sophos Chief Technology Officer John Peterson argues that advancing frontier artificial intelligence is narrowing the defensive window in cybersecurity, requiring defenders to integrate autonomous reasoning models with deep operational domain knowledge. Through OpenAI's Daybreak program, Sophos has scaled its operations to automate roughly half of its Security Operations Center investigations while maintaining strict human-in-the-loop governance over active remediation. Threat Acceleration and the Defender's Window (0:08) According to Peterson, the cybersecurity defense window is compressing as advances in frontier AI models rapidly filter down into open-weight alternatives. This dissemination accelerates exploit development and drives an influx of Common Vulnerabilities and Exposures (CVEs), allowing even novice attackers to inflict significant operational damage. With over four decades in the security sector and approximately 650,000 customer organizations globally, Sophos views frontier AI as both a compounding risk and an essential defensive capability. To counter this rapid weaponization, Peterson explains that proprietary threat intelligence, operational telemetry, and incident response playbooks cannot scale on human labor alone. By integrating OpenAI’s Daybreak program, Sophos aims to combine decades of human practitioner knowledge with frontier reasoning capabilities, allowing defensive playbooks to scale dynamically across its customer base. Compressing SOC Investigations via Agentic Architecture (3:44) Peterson describes the implementation of Daybreak-powered agents within the Sophos Fusion platform, which underpins the company's Managed Detection and Response (MDR) and Extended Detection and Response (EDR/XDR) offerings. The platform ingests telemetry across more than 500 third-party and native security integrations, processing trillions of raw events daily. This volume is distilled down to between 1,000 and 2,000 actionable cases per day, distributed across nine global Security Operations Centers (SOCs). Prior to deploying these autonomous agents, human analyst investigations averaged approximately 38 minutes per incident—a benchmark Peterson noted already outperformed 96% of global SOCs. Autonomous agents executing an iterative plan-execute-review loop now ingest contextual telemetry, threat indicators, and environmental data to reduce investigation times to roughly 89 seconds for automated cases. Currently, these autonomous agents handle approximately 50% of all incoming SOC cases. Supervisory Guardrails and Tiered Operating Modes (6:57) Addressing chronic industry shortages in cybersecurity talent, Peterson notes that AI automation allows security providers to scale computing resources rather than headcount, freeing human analysts from routine investigations to concentrate on complex, high-risk attacks. However, because automated responses introduce operational risks, Sophos aligns its AI agents with the same three-tier governance framework historically applied to human analysts: Notify, Collaborate, and Authorize. Under Notify mode, agents and analysts perform investigations and suggest remediations without taking independent action. Collaborate mode requires joint execution between Sophos and the customer, while Authorize grants permission to execute proactive containment immediately. Peterson emphasizes that human verification remains strictly mandatory whenever an action risks disrupting production environments, such as isolating mission-critical infrastructure or terminating key services. Foundational Hygiene in an Accelerated Threat Landscape (11:08) Peterson cautions security leaders against becoming distracted by emerging AI tools at the expense of defensive fundamentals. While autonomous agents assist overburdened operations teams with alert volume, Peterson argues that AI cannot compensate for basic operational gaps in an environment where automated tooling enables low-skill adversaries to strike rapidly. Peterson outlines four indispensable defensive pillars: systematic patch management to address third-party and open-source CVEs, the deployment of robust endpoint protection, ubiquitous multi-factor authentication (MFA) across all identity systems, and rigorous network segmentation to limit lateral movement. These fundamentals, he states, must form the baseline that agentic security operations wrap around. Peterson concludes that while autonomous agents provide critical operational relief against accelerated, AI-driven threats, security resilience continues to depend on strict human supervision of destructive actions and consistent maintenance of foundational defensive hygiene.

精炼阅读摘要

Sophos首席技术官John Peterson指出，前沿AI的加速演进与技术扩散使安全漏洞的利用门槛大幅降低，导致网络防御者的响应窗口急剧收窄；通过将公司长期的攻防经验与OpenAI Daybreak前沿智能相结合，安全团队能够以算力克服人才瓶颈并重塑调查流程，但在关键处置环节必须维持严格的人工监督与基础安全防线。 前沿AI扩散与防御者窗口急剧收窄 (0:08) Peterson强调，当前网络安全领域面临的核心挑战源于前沿AI技术的指数级迭代。随着顶尖模型的代码与攻防能力迅速下沉至开源权重模型，通用漏洞披露（CVE）的发现与武器化利用进程显著提速，初级攻击者借助AI工具即可发起高破坏性渗透，这迫使防御方必须在更短的时间内完成阻断。面对为全球约65万家机构客户提供防护的体量与自身面临的攻防压力，Sophos选择接入OpenAI的Daybreak计划以应对这一局面。 在Peterson的分析中，单纯依靠传统专业知识和有限的专家人力，已无法抵御现代攻击在规模与速率上的激增。Sophos积累了逾40年的行业资产，涵盖海量威胁情报库、实战应急响应预案及专业人员认知。将这些深厚的领域沉淀与前沿大模型的推理能力相融合，能够将静态的专家经验转化为可规模化调用的防御算力，从而抢在攻击者前沿技术普及之前筑牢防线。 从38分钟到89秒的调查流程重构 (3:44) 在技术落地层面，Sophos将基于Daybreak的自主调查代理集成进其底层核心分析引擎Sophos Fusion平台中。该平台承载着托管检测与响应（MDR）以及扩展检测与响应（EDR/XDR）业务，每天从原生传感器和500多个第三方安全工具中接入数万亿条原始遥测数据，并将其筛选、提炼为分布于全球9个安全运营中心（SOC）的1,000至2,000起高优先级待调查案例。 根据Peterson提供的数据，约18个月前纯人工分析阶段，Sophos单起案例的平均调查耗时约为38分钟，该速度已领先于全球96%的专业SOC。而在引入Daybreak调查代理后，由AI接管的案例平均调查时间急剧缩短至约89秒，且全平台已有约50%的工单实现自主处理。调查代理通过“规划-执行-复核”闭环，自主整合遥测告警、威胁指标（IOC）及客户环境上下文，完成取证推演并输出结构化总结与行动建议，实现了运营效率的量级跨越。 分级治理框架与破坏性操作的人工监督 (6:57) 伴随调查速度的大幅提高，处置环节的风险控制与信任建立成为关键。Peterson表示，Sophos对AI代理沿用了与人类分析师完全一致的治理框架，通过三种MDR运行模式明确行动边界：“通知”模式下系统仅出具排查与处置建议，不采取任何独立动作；“协作”模式下由Sophos与客户协同商讨并共同执行；“授权”模式则全权委托Sophos代表客户直接执行遏制与修复。分级机制使客户能依据自身的IT成熟度与风险偏好精确设定控制权限。 尽管AI在调查端的自主化不断扩展，Peterson明确将“潜在破坏性动作”划为人机协同的绝对红线。他指出，凡涉及隔离核心生产服务器、关停关键业务服务等可能导致系统中断的操作，系统必须触发强制性的人类专家复核机制。Sophos的首要准则是确保客户在获得安全防护的同时维持业务连续性，坚决避免自动化脚本误判导致“自我伤害型”停机事件。 算力扩充人力与不可替代的安全基石 (11:08) 在团队与运营维度，Peterson指出整个网络安全产业长期受困于顶尖分析师与响应专家的严重短缺，中小机构组建7×24小时高水平SOC的成本极其高昂。AI代理的应用本质上是将防御规模的扩张逻辑由“增加人力编制”转变为“扩展算力资源”，将人类专家从常规繁杂的报警初筛中解脱出来，集中精力研判高复杂度的定向攻击。 面对快速更迭的AI浪潮，Peterson同时告诫安全管理者切忌本末倒置。前沿AI的普及没有降低基础防御的价值，反而对底线卫生提出了更高要求。他强调，组织必须严抓不可替代的基础防线：持续针对软件依赖项开展CVE漏洞管理与补丁修复、部署高等级端点防御体系、在所有身份验证节点强制推行多因素认证（MFA），并实施严格的网络分段以抑制横向渗透。只有在底座坚固的前提下，AI驱动的现代安全运营体系才能充分发挥其防御倍增效能。 本场对话展示了顶级安全厂商如何将前沿大模型内嵌至核心运营闭环，通过算力弥补人才缺口并抵消漏洞利用加速带来的冲击。然而，随着威胁自动化进一步加剧，如何在非破坏性操作与高风险阻断之间维系精细的自动化边界，以及企业客户能否在拥抱AI工具的同时真正补齐基础安全短板，仍是该防御范式面临的长期检验。

Detailed notes — zh

## Background 该视频由 OpenAI 于 2026 年 9 月 29 日发布在 YouTube 平台上。视频简介指出，OpenAI 欧洲、中东及非洲数字化原生客户总监 Claire Lawlor 与 Sophos 首席技术官 John Peterson（JP）在此次对谈中深入阐述了技术合作伙伴生态在抵御现代网络威胁中的核心作用。 ## TL;DR 随着前沿 AI 能力扩散导致网络攻击门槛大幅降低，防守方的时间窗口正在被极速压缩。Sophos 借助与 OpenAI 的 Daybreak 项目合作，将数十年的攻防领域知识与顶尖模型智能结合，使其 Fusion 平台中的 AI Agent 能够将日常安全用例的平均调查时间从 38 分钟断崖式压缩至 89 秒，并接管了约半数案例的自动化调查。为了在解决安全人才荒的同时规避业务风险，Sophos 确立了通知、协作与授权三种响应机制，并在潜在破坏性操作上坚决保留人类审核红线。双方最终呼吁，在积极引入 Agent 自动化的同时，企业必须牢固筑实漏洞修复、顶级端点防护和强身份认证等底层安全基本功。 ## Atmosphere & style 现场对谈的氛围兼具技术深度与轻松风趣，Claire 开场拿 JP 跨越三大时区连夜抵英的疲惫打趣调侃，迅速化解了餐后讲座的沉闷。在随后的讨论中，JP 虽略显旅途奔波后的疲态，但在剖析每日万亿级事件过滤与 Agent 闭环时展现出了极高的工程专业度与沉稳底气，抛出的“89 秒”等硬核对比数据极具冲击力。整场交流传递出一种理性务实的克制感——既对前沿 AI 带来的指数级人效提升感到振奋，又始终冷静审慎地捍卫人类对破坏性操作的最终裁决权与基础安全防线。 ## Bulletin - [04:04](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=244s) Sophos 接入基于 OpenAI Daybreak 构建的调查 Agent，将高价值安全事件的平均调查耗时从此前行业领先的约 38 分钟大幅削减至 89 秒，目前已有约半数日常案例由 Agent 自动化处理。 - [01:12](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=72s) 前沿 AI 技术正加速向开源与开放权重模型下沉，使得漏洞挖掘与自动化攻击的门槛急剧降低，直接导致近期全网 CVE 数量暴增并大幅压缩了“防守方时间窗口”。 - [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) 针对网络安全行业长期的专业人才匮乏，AI Agent 推动企业防御能力的横向扩展摆脱对线性增加人力的依赖，转而依靠模型推理带来的弹性算力扩展。 - [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) Sophos 在响应机制中严格划分通知、协作与授权三种模式，并明确界定人机信任红线：凡涉及可能造成业务破坏性后果的操作，必须经过人工专家（Human-in-the-loop）的终审。 ## Key takeaways - [00:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=8s) Sophos 拥有 40 年网络安全攻防积淀，为全球跨行业的 65 万家企业提供防护，具备深厚的实战威胁情报与事件处置经验。 - [01:12](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=72s) 前沿模型能力的普及正在下沉至开源/开放权重模型，攻击门槛的降低导致漏洞利用路径极速加快，使防守方的时间窗口日益收窄。 - [01:12](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=72s) OpenAI 与 Sophos 的生态合作形成了能力互补：Sophos 贡献深厚的领域专家知识、威胁情报与处置预案，OpenAI 则以前沿模型为算力引擎将其规模化放大至海量客户。 - [04:04](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=244s) Sophos Fusion 平台通过 500 多个传感器接口日均吞吐数万亿底层事件，经提炼后将 1,000 至 2,000 起核心案例下发至全球 9 大 SOC 开展调查。 - [04:04](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=244s) 在引入 Daybreak Agent 前，Sophos 资深分析师平均调查耗时约 38 分钟（优于 18 个月前 96% 的专业 SOC）；引入后，由 Agent 驱动的案例调查平均仅需 89 秒。 - [04:04](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=244s) 调查 Agent 基于客户环境信息、IOC 与威胁情报，通过“规划—执行—复核”（plan-execute-review）闭环展开取证，并向 SOC 人员输出结构化摘要与处置建议。 - [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) 网络安全人才荒使中小企业难以自建 7×24 小时 SOC，AI Agent 的引入旨在将高精尖分析师从机械性调查中解放出来，实现防守能力的算力化扩展。 - [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) 为契合不同客户的风险偏好与控制需求，Sophos 制定了仅调查并引导建议的“通知模式”、必须客户确认方可动作的“协作模式”，以及完全交由系统止损的“授权模式”。 - [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) 自动化系统必须坚守人机安全边界：任何可能带来业务破坏性后果的敏感响应动作，均必须通过人工在环机制移交人类专家裁决。 - [10:06](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=606s) 安全运营的首要原则是“在保障客户安全的同时确保其业务连续运转”，技术的演进不能以牺牲客户的环境掌控权或业务正常运行为代价。 - [11:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=668s) 在攻击门槛大幅降低的背景下，防御方最核心的应对策略并非盲目追逐前沿概念，而是把网络安全的基本功落实得比以往任何时候都更加扎实。 - [11:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=668s) 扎实的安全基础体系包括：高频的 CVE 漏洞补丁管理、高水准的端点防护（Endpoint Protection）、全覆盖的 MFA、严密的网络分段以及现代化的安全运营（SecOps）。 ## Detailed walkthrough ### [00:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=8s) 跨大西洋奔波与四十年网络安全积淀 活动开场时，来自 OpenAI 的 Claire Lawlor 带着轻松幽默的语调向现场观众介绍 Sophos 首席技术官 John Peterson（业内常称 JP）。Claire 调侃道，如果说主持人 Matt 刚才提到了下午茶歇后的“餐后昏睡期”（post-lunch slump），那么全场最有正当理由犯困的绝对是 JP——他在本周伊始还在美国东海岸，随后飞往西海岸，又在昨晚连夜飞抵伦敦，因此希望大家对他“手下留情”。JP 笑着向台下问好并展开自我介绍，他指出 Sophos 作为全球规模最大的网络安全公司之一，拥有横跨各个行业与细分市场的约 650,000 家客户。在长达四十年的网络安全实战中，这种全球化布局使 Sophos 能够目睹形形色色的攻击手段，并积累了海量的防御对抗专业知识。 - **发言嘉宾**：Claire Lawlor（OpenAI 欧洲、中东及非洲数字化原生客户总监）与 John Peterson / JP（Sophos 首席技术官）。 - **Sophos 业务规模**：服务全球超过 65 万家企业客户，深耕网络安全行业逾 40 年。 --- ### [01:12](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=72s) 前沿智能加速下的“防守方时间窗口”与生态协作 谈及 Sophos 作为 OpenAI 的 Daybreak 合作伙伴，Claire 抛出了业界高度关注的核心议题——日益收窄的“防守方时间窗口”（defenders window）。JP 解释称，防守方时间窗口的本质是前沿人工智能（frontier intelligence）的技术演进速度。随着顶尖前沿模型展现出愈发复杂的网络安全对抗能力，这些能力正逐步下沉到开源/开放权重（open-weight）模型中，进而大幅降低了攻击门槛，导致漏洞利用路径极速加快。这一点在近几年全网通用漏洞与披露（CVE）数量的爆发式激增中体现得尤为明显。对于 Sophos 而言，不仅自身作为一个大型安全厂商是黑客攻击的显眼目标，更有义务保护 65 万家客户的安全。借助 Daybreak 等前沿项目，防守方得以反向利用顶级 AI 智能，在攻击者得手前抢先一步。 Claire 随后探讨了技术与人类专业知识的融合：OpenAI、Sophos 与终端客户应如何在生态中协同运作？JP 表示，Sophos 的核心价值在于数十年来积累的深厚安全领域专业知识（domain expertise），涵盖威胁情报、事件处置应急预案（response playbooks）以及一线专家的实战经验。然而，面对海量攻击，仅靠人力难以无限制扩展。OpenAI 与 Daybreak 提供的顶尖模型智能，正是将这些人类安全知识以指数级能力放大并扩展至全部客户的引擎，使得整个防御生态得以实现兼具深度与规模的高效运转。 - **威胁态势**：前沿 AI 能力向开源模型扩散，导致漏洞挖掘与攻击路径自动化，近年 CVE 数量显著攀升。 - **生态分工**：Sophos 提供攻防领域专业知识、威胁情报与处置策略；OpenAI 提供前沿智能以支撑大规模算力扩展；客户则获得高一致性与低延迟的安全保障。 --- ### [04:04](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=244s) Sophos Fusion 平台与 Daybreak Agent：将调查时间从 38 分钟缩减至 89 秒 为了给在场的 EMEA 安全高管们提供一个具象的业务落地参考，JP 深入拆解了 Sophos Fusion 系统的底层架构与 Agent 运作流程。Sophos Fusion 是支撑其托管检测与响应（MDR）服务以及 EDR、XDR 产品矩阵的核心中枢。该系统通过 500 多个传感器接口整合第三方安全产品与 Sophos 自研工具的数据，每天接入数以万亿计的底层事件，并经过层层过滤提炼出大约 1,000 到 2,000 起高价值安全事件用例（cases），分发给全球 9 个安全运营中心（SOC）进行调查。在引入生成式 AI Agent 之前，这一过程全靠资深分析师纯手工调查与处置。即便在那时，Sophos 团队凭借严密的流程将平均调查时间压缩在约 38 分钟左右，这一表现放在 18 个月前已经优于全球 96% 的专业 SOC。 然而，在接入基于 Daybreak 模型构建的调查 Agent 后，处置效率发生了翻天覆地的跃迁：由 Agent 自动驱动的案例，其平均响应时间暴跌至仅约 89 秒。目前 Sophos 承接的日常安全案例中，已有大约半数完全由这些 Agent 自动化调查处理。在具体执行上，调查 Agent 会抓取案例上下文、客户环境信息、检测警报、威胁指标（IOCs）以及最新威胁情报，输入至规划模型中；模型形成“规划—执行—复核”（plan-execute-review）循环，逐步开展取证与研判，最终为人类分析师生成清晰的调查摘要和建议处置方案，甚至交由响应 Agent 执行基础处置。 ```mermaid flowchart TD accTitle: Sophos Fusion 与 Daybreak Agent 威胁调查流程 accDescr: 展示从底层传感器事件汇聚到 SOC 案例生成，再经由规划模型循环并交由人类审核的完整架构流程。 subgraph DataIngest["数据接入与提炼"] A["500+ 传感器与第三方集成"] --> B["每日万亿级安全事件"] B --> C["精炼至每日 1,000-2,000 起核心案例"] end subgraph AgentLoop["Daybreak Agent 自动化调查"] C --> D["输入客户上下文 / IOC / 检测数据"] D --> E["规划模型 (Planning Model)"] E --> F["'规划-执行-复核' 闭环调查"] F --> G["生成案例摘要与响应建议"] end subgraph Operation["SOC 运营与响应"] G --> H{"9处 SOC 分析师 / 响应 Agent"} H --> I["89秒快速研判与威胁消除"] end ``` - **数据吞吐与过滤**：500 多项传感器集成，日均吞吐数万亿事件，蒸馏汇聚为 1,000–2,000 个案例并分发给 9 大全球 SOC。 - **调查时效对比**： - **传统纯人工模式**：平均调查时间约 38 分钟（超越 18 个月前 96% 的专业 SOC）。 - **Daybreak Agent 模式**：平均调查时间缩短至 89 秒。 - **业务覆盖率**：目前约 50% 的日常安全用例已由 Agent 自动化协助或独立运行完成。 --- ### [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) 应对网络安全人才荒与防范破坏性操作的三种响应模式 针对 Claire 关于“大幅缩短响应时间后节省出的精力流向何处”的提问，JP 指出，网络安全行业长期深陷专业人才极度匮乏的窘境。许多企业无法独立搭建 7×24 小时全天候运转的 SOC 团队，这也是 MDR 业务在全球大获成功的根本原因。AI Agent 的核心价值并非裁减人员，而是让现有的高端分析师从机械性排查中解脱出来，使安全能力的横向扩展摆脱对“线性增加人力”的依赖，转而依靠“按需扩展算力”。 至于发现威胁后如何做响应决策、机器与人类的信任边界在何处，JP 强调这涉及严谨的判断机制。Sophos 从业务创立伊始就设立了三种清晰的运营响应模式，无论是人类操作还是 Agent 执行都必须无差别遵循： 1. **通知模式（Notify）**：SOC 与 Agent 负责对安全案例开展全面彻底的调查，但绝不会自主执行任何处置操作；团队仅向客户提供引导并推荐具体措施。 2. **协作模式（Collaborate）**：团队完成端到端调查后与客户协同处置，在未获得客户直接确认与参与前绝不单独采取任何操作。 3. **授权模式（Authorize）**：客户向 Sophos 授予完全处置权限，团队与系统可第一时间主动采取遏制与阻断行动以确保系统安全。 JP 指出，设置这三种模式旨在根据不同客户的技术水位与心理预期“因地制宜”。在引入自动化 Agent 时，虽然团队追求极限速度与人效提升，但绝不会在安全边界上妥协：一旦面对可能带来业务破坏性后果（destructive response）的敏感操作，系统会坚决设置人工干预闸门，将决策权移交给人类专家进行最终把关。 - **规模化路径**：将依赖昂贵且稀缺的人力扩展模式，转变为依托模型推理与计算资源的算力弹性扩展模式。 - **MDR 三大运作模式**： - **Notify（通知）**：深度调查 + 提供修复建议，无独立执行权。 - **Collaborate（协作）**：联合研判，必须有客户协同参与方可处置。 - **Authorize（授权）**：获得完全托管信任，可直接执行处置与止损操作。 - **人机安全红线**：只要涉及可能对业务环境造成破坏的危险响应动作，必须通过 Human-in-the-loop 机制交由人类专家进行权威裁决。 ### [10:06](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=606s) 响应自动化与人类监督的平衡演进 在讨论安全运营流程时，尽管 AI Agent 已经能够实现大量的调查自动化，但在实际的事件响应环节中，人类专家的判断仍然扮演着核心角色。Claire Lawlor 问及这一协作机制未来将如何演进。Sophos 首席技术官 John Peterson（JP）略带疲惫但风趣地坦言自己昨晚休息不足，Claire 则随即给予鼓励打气。JP 进一步解释，未来的响应能力必将持续变得更加精密，Sophos 也会不断拓宽自主构建的 Agent 所覆盖的业务场景；但在现阶段以及可预见的未来，针对任何可能对客户环境造成破坏性影响的操作，人类监督都将是一道不可逾越的底线。 JP 强调，安全团队的首要任务是“确保客户不仅受到保护，还能维持正常业务运转”（keeping customers protected and operational）。Claire 补充总结道，这意味着在保障防护与运行的同时，还要把掌控权交还给客户，由客户自主决定是授予系统全自动执行授权，还是仅维持通知模式。JP 对此完全赞同，明确指出技术的演进绝不能以剥夺客户的环境控制权或牺牲业务连续性为代价。 ```mermaid flowchart LR accTitle: 人机协同响应架构示意图 accDescr: 展示 AI Agent 自动化分析与人类监督共同参与的防护与响应流程 subgraph AgentLayer["AI Agent 自动化层"] A["自动化威胁调查与关联"] --> B["生成响应策略与建议"] end subgraph DecisionLayer["客户授权与控制"] B --> C{"破坏性操作评估"} C -->|"低风险/常规"| D["全自动执行"] C -->|"潜在业务风险"| E["人工审核 / 仅发送通知"] end subgraph OpsLayer["核心业务保障"] D --> F["保障业务连续运行"] E --> F end ``` - **任务核心准则**：在提升自动化响应效率的同时，守住“保护客户并保障业务连续性”的第一底线。 - **差异化授权策略**：提供“完全自动化执行”与“仅通知告警”的双轨控制机制，确保关键操作处于人类监管之下。 --- ### [11:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=668s) 防御窗口收紧下的安全基本功与落地方案 针对现场与会的安全主管们，Claire 询问企业若要开启与 Sophos 的合作，第一步应当如何落地。JP 直言，在当前防御窗口逐渐收窄、前沿智能技术飞速发展、甚至新手攻击者都能造成重大现实破坏的环境下，“把基本功做好比以往任何时候都更加关键”。他指出，很多团队容易被技术的飞速迭代所分散精力，但最根本的防御能力始终不可偏废。 JP 梳理了构建坚固防御体系所必须落实的核心要素：必须建立完善的漏洞补丁管理机制，以应对各大厂商和开源社区不断披露的 CVE 漏洞；更重要的是，部署最高水准的端点防护（Endpoint Protection）在当今比以往更为紧迫。此外，全身份基础设施的 MFA（多因素认证）覆盖、扎实严密的人工/网络分段（Network Segmentation），以及统揽全局的健壮安全运营（SecOps）体系，构成了不可替代的底座。Sophos 正是在这些关键领域全面布局。 Claire 总结道，这绝非倡导放弃安全底座去追逐所谓前沿概念，JP 也确认这一点绝非反直觉的激进观点——安全团队固然要倾尽所能借助 Agent 自动化来化解安全运营团队激增的工作负荷，但绝不能以牺牲端点安全等基础能力为代价。对谈尾声，Claire 感谢了 JP 的精彩分享，并提醒台下观众在当天的开放吧台环节可以继续与 JP 深入探讨交流，随后介绍了接下来登场的演讲嘉宾——OpenAI 欧洲、中东和非洲地区政策副总裁 Tom Duff Gordon。 - **收窄的防御窗口**：前沿 AI 能力拉低了攻击门槛，使初级黑客同样具备高破坏力，倒逼防御方回归实操基础。 - **关键防御基石清单**： - **漏洞与补丁管理**：及时修复各类厂商和开源生态中的已知 CVE 漏洞。 - **顶尖端点安全**：筑牢设备侧最坚实的第一道防线。 - **强身份验证与网络隔离**：全员推行 MFA 并执行严格的网络分段。 - **现代化安全运营体系**：以自动化 Agent 缓解工单负荷，同时由成熟的 SecOps 体系全局把控。 ## Notable quotes > [01:12](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=72s) 随着顶尖前沿模型展现出愈发复杂的网络安全对抗能力，这些能力正逐步下沉到开源/开放权重（open-weight）模型中，进而大幅降低了攻击门槛，导致漏洞利用路径极速加快。 — John Peterson > [01:12](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=72s) OpenAI 与 Daybreak 提供的顶尖模型智能，正是将这些人类安全知识以指数级能力放大并扩展至全部客户的引擎，使得整个防御生态得以实现兼具深度与规模的高效运转。 — John Peterson > [04:04](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=244s) 即便在那时，Sophos 团队凭借严密的流程将平均调查时间压缩在约 38 分钟左右，这一表现放在 18 个月前已经优于全球 96% 的专业 SOC。 — John Peterson > [04:04](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=244s) 由 Agent 自动驱动的案例，其平均响应时间暴跌至仅约 89 秒。目前 Sophos 承接的日常安全案例中，已有大约半数完全由这些 Agent 自动化调查处理。 — John Peterson > [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) AI Agent 的核心价值并非裁减人员，而是让现有的高端分析师从机械性排查中解脱出来，使安全能力的横向扩展摆脱对“线性增加人力”的依赖，转而依靠“按需扩展算力”。 — John Peterson > [06:57](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=417s) 在引入自动化 Agent 时，虽然团队追求极限速度与人效提升，但绝不会在安全边界上妥协：一旦面对可能带来业务破坏性后果（destructive response）的敏感操作，系统会坚决设置人工干预闸门，将决策权移交给人类专家进行最终把关。 — John Peterson > [10:06](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=606s) 安全团队的首要任务是“确保客户不仅受到保护，还能维持正常业务运转”（keeping customers protected and operational）。 — John Peterson > [11:08](https://www.youtube.com/watch?v=zoohZ1BiHs0&t=668s) 在当前防御窗口逐渐收窄、前沿智能技术飞速发展、甚至新手攻击者都能造成重大现实破坏的环境下，“把基本功做好比以往任何时候都更加关键”。 — John Peterson ## Mentioned Claire Lawlor, John Peterson, Matt, Tom Duff Gordon, OpenAI, Sophos, Daybreak, Sophos Fusion, MDR, EDR, XDR, SOC, CVE, MFA, SecOps ## Video description Claire Lawlor, Digital Native AD EMEA at OpenAI, and John Peterson, CTO at Sophos, explain the role of technology partnerships in keeping organizations safe from cyber threats [Source](https://www.youtube.com/watch?v=zoohZ1BiHs0)

Source quotes

[1:12] John Peterson: 随着顶尖前沿模型展现出愈发复杂的网络安全对抗能力，这些能力正逐步下沉到开源/开放权重（open-weight）模型中，进而大幅降低了攻击门槛，导致漏洞利用路径极速加快。 [1:12] John Peterson: OpenAI 与 Daybreak 提供的顶尖模型智能，正是将这些人类安全知识以指数级能力放大并扩展至全部客户的引擎，使得整个防御生态得以实现兼具深度与规模的高效运转。 [4:04] John Peterson: 即便在那时，Sophos 团队凭借严密的流程将平均调查时间压缩在约 38 分钟左右，这一表现放在 18 个月前已经优于全球 96% 的专业 SOC。 [4:04] John Peterson: 由 Agent 自动驱动的案例，其平均响应时间暴跌至仅约 89 秒。目前 Sophos 承接的日常安全案例中，已有大约半数完全由这些 Agent 自动化调查处理。 [6:57] John Peterson: AI Agent 的核心价值并非裁减人员，而是让现有的高端分析师从机械性排查中解脱出来，使安全能力的横向扩展摆脱对“线性增加人力”的依赖，转而依靠“按需扩展算力”。 [6:57] John Peterson: 在引入自动化 Agent 时，虽然团队追求极限速度与人效提升，但绝不会在安全边界上妥协：一旦面对可能带来业务破坏性后果（destructive response）的敏感操作，系统会坚决设置人工干预闸门，将决策权移交给人类专家进行最终把关。 [10:06] John Peterson: 安全团队的首要任务是“确保客户不仅受到保护，还能维持正常业务运转”（keeping customers protected and operational）。 [11:08] John Peterson: 在当前防御窗口逐渐收窄、前沿智能技术飞速发展、甚至新手攻击者都能造成重大现实破坏的环境下，“把基本功做好比以往任何时候都更加关键”。

Source quotes

[0:08] Claire Lawlor: narrowing defender's window [3:44] John Peterson: before time [3:44] John Peterson: plan-execute-review loop [6:57] John Peterson: Notify [6:57] John Peterson: Collaborate [6:57] John Peterson: Authorize [10:06] John Peterson: mission one

Original transcript

[0:08] I'm delighted to be joined by by JP and [0:11] if Matt mentioned the post afternoon [0:13] post lunch slump I think of all people [0:16] JP probably has the excuse to maybe have [0:19] a little bit of a slump uh having [0:21] traveled from the east coast at the [0:23] start of the week to the west coast to [0:26] arriving in London last night. [0:28] >> Yes. Uh so please go easy on them. Um [0:31] with that JP would be great to introduce [0:33] yourself to the audience um and to tell [0:36] us a little bit about Sophos please. Hey [0:38] >> everybody it's great to be with you here [0:39] today. I'm John Peterson. I'm chief [0:41] technology officer at Sophos and Sofos. [0:44] For those of you that may not know us we [0:46] are one of the largest cyber security [0:48] companies in the world. We have about [0:50] 650,000 customers that are spread across [0:53] the you know with a global footprint and [0:55] they really span every segment every [0:58] sector and as such we see a huge variety [1:02] of different attacks we and we've [1:04] cultivated you know vast expertise in [1:07] combating them over four decades of [1:09] being in the cyber security business. So [1:11] it's great to be with you here today. [1:12] >> Thanks JP. Yeah great to have you. Um, [1:15] Sofus is a Daybreak partner and we're [1:18] speaking a lot today about the narrowing [1:20] defenders window. Um, what does the [1:23] defenders mean for window mean for Sofus [1:26] um and how you protect your customers? [1:28] >> Yeah, that's great. So, the um we think [1:30] of the defenders window in terms of the [1:32] um the pace of acceleration in frontier [1:35] intelligence. So, the leading frontier [1:38] models are developing more and more [1:40] sophisticated cyber capabilities. those [1:43] are working their way down into the [1:44] openweight models as well and that's [1:46] driving you know a faster exploitation [1:49] paths more vulnerabilities we're seeing [1:51] that in the CVEes as well um just the [1:54] level of CVS has gone up massively in [1:56] the last few years and so we think about [1:59] it in terms of we have an opportunity to [2:02] take advantage of the frontier um [2:03] frontier intelligence through programs [2:05] like Daybreak that allow us to stay a [2:07] step ahead of the attackers um and we we [2:10] look at that in terms of protecting [2:11] ourselves at sofa because as a large [2:14] cyber security company, we're obviously [2:15] a target, but we also have 650,000 [2:18] customers who and it is our obligation [2:21] to protect them. So, we have an [2:23] opportunity, I think, with programs like [2:25] Daybreak to stay a step ahead um of the [2:28] attacker community. [2:30] >> Yeah. Um and I guess that protection [2:32] takes a combination of technology and [2:35] expertise. Um, so how do OpenAI, Sophus, [2:39] and the customer each contribute to [2:42] making this essentially work for the [2:44] entire ecosystem? [2:45] >> Yeah, that's that's a good question. I [2:46] think the way that I think about that is [2:49] Sophos is Sophos contain we have lots of [2:52] cyber security domain experts, right? [2:54] We've been in the cyber security [2:55] business a long time and we've, you [2:57] know, it's our business to protect our [2:59] customers and that that domain expertise [3:02] takes a variety of forms. So threat [3:04] intelligence um you know response [3:07] playbooks when we're managing incidents [3:08] on behalf of customers um and also just [3:11] the expertise of our people. So I look [3:13] at it as Sophos brings the domain [3:15] expertise and the where the the knowhow [3:18] to actually combat attacks at scale but [3:21] then the programs like Daybreak and Open [3:25] and companies like OpenAI bring frontier [3:27] intelligence that allow us to take that [3:30] domain expertise and then scale it to [3:32] support all of our customers. Um, and [3:33] that's what's been so powerful about the [3:35] program and what it's allowed us to [3:36] build. [3:37] >> Yeah, it's been fantastic to see that [3:38] that partnership go from from strength [3:40] to strength in recent months. [3:43] >> Absolutely. [3:44] >> Um, I guess we're we're joined by some [3:46] of the leading uh security leaders [3:49] across AMIA here today. Maybe let's um [3:53] give them a little bit more of a a [3:54] practical example here. um can you walk [3:57] us through an example of how a Daybreak [4:00] um powered agent helps your team [4:02] investigate a threat? [4:04] >> Yep, absolutely. So, I think the the [4:06] place that I would start in explaining [4:08] that is the um by just explaining the [4:10] Sophos Fusion system, which is the [4:12] system that powers the managed detection [4:15] response service at Sophos and all of [4:17] our EDR and XDR um products. So these [4:20] systems are built um leveraging sensor [4:23] data from over 500 different [4:24] integrations um with thirdparty security [4:27] products but also our own products as [4:29] well. Those sensors are producing like [4:31] trillions of events every day. And those [4:34] events get distilled down really into a [4:36] small set of about a thousand to 2,000 [4:38] cases a day that are you know nine [4:40] different security operations centers [4:42] are um investigating on behalf of [4:45] customers. And so that process of taking [4:48] a case, conducting the investigation and [4:51] then remediating whatever the threat is. [4:53] Historically that was driven primarily [4:55] by human expertise. And you know in the [4:58] before time right that human expertise [5:01] um and the processes that we built [5:02] around it allowed us to have around a 38 [5:05] 38 minute average response time uh for [5:08] or average investigation time on those [5:10] cases which is you know at the time like [5:13] 18 months ago that was better than 96% [5:16] of professional security operations [5:18] centers. Um but now because of the the [5:21] agents that we've been able to build [5:22] leveraging the Daybreak program, the um [5:25] the average response time for cases that [5:28] are leveraging the agents that we've [5:30] built has reduced to about 89 seconds. [5:32] So that's about half of the half of the [5:34] cases that we handle are now being [5:37] automated by agents that we've developed [5:40] using the uh the Daybreak the Daybreak [5:42] models. And that's um obviously that's [5:44] been transformative in terms of the um [5:47] the effort that it takes for us to [5:49] actually conduct those investigations, [5:50] but it also results in better customer [5:52] outcomes. And to to provide a little [5:54] more detail about how that actually [5:57] works in practice, we have these cases [5:59] that come into the security operations [6:01] team. And the um the cases themselves [6:05] are are are are now handled primarily by [6:08] a investigation agent that we've [6:10] developed that takes all of the [6:12] information from the case. Customer [6:15] context detections, indicators of [6:17] compromise, um you know, knowledge of [6:19] the um the the threat landscape. And it [6:22] feeds that into a planning model which [6:25] then creates a kind of plan execute um [6:28] review loop and goes through it creates [6:30] an investigation plan, conducts the [6:32] investigation steps and then creates a [6:35] summary for the analysts to review and [6:37] then a set of recommended response [6:38] actions and then we have agents that [6:40] we've built as well that handle some of [6:42] the response. But that's a little bit of [6:44] background and to how the whole thing [6:45] actually functions. And it's been [6:47] transformative because it allows us to [6:49] respond more quickly, but it also gives [6:51] customers broadly a more consistent a [6:54] more consistent outcome, which is what [6:56] we're really in the business of doing. [6:57] >> And I guess given that you're halfing [6:59] that time to response, where where are [7:01] those efforts then being placed? Where [7:03] are you putting th the additional time [7:04] and effort? And how are you as a a [7:07] leader making those decisions and and [7:09] where that time is spent as well? Yeah, [7:11] I mean the a big part of the value is is [7:14] that well let me take a step back. So [7:16] the um cyber security expertise has [7:19] always been in short supply. One of the [7:22] the reasons that our MDR business has [7:24] been so successful and why other MDR [7:26] businesses have also been successful is [7:28] because it's actually hard to find [7:31] security operations analysts that have [7:33] the expertise to protect customers. it's [7:35] hard to staff your own sock um you know [7:38] and have 247 response capabilities. [7:41] So you know what this has allowed us to [7:43] do is help with that talent help help to [7:45] use the talent that we have in the in [7:47] the organization more effectively and [7:49] more efficiently so that we can we can [7:51] scale our we can scale the compute in [7:53] ter as opposed to the personnel that are [7:55] supporting the MDR business. [7:57] >> Yeah, I think that's great to hear JP. I [7:59] think uh there's not a person in this [8:01] room that probably doesn't feel that uh [8:03] that skills uh gap in in terms of cyber [8:06] security, I'm sure. Um [8:09] finding a threat, right, is is is one [8:11] thing, but deciding how to respond is [8:14] really where trust and judgment matter. [8:17] So, how do you decide when to act on [8:20] what an agent does find? [8:22] >> That's a great question. Um so at at [8:25] Sophos the way that we've [8:28] structured our MDR business from the [8:29] beginning um kind of takes this problem [8:32] into account because it's a problem if [8:33] it's humans doing it. It's also a [8:35] problem if it's agents doing it. Um so [8:37] the way that we've approached this is by [8:39] starting with we have three basically [8:40] basic operating modes that we operate [8:43] within. First is called notify and in [8:45] that mode um our sock will investigate a [8:48] case fully on behalf of customers but [8:50] we'll never take a response [8:51] independently. um we guide the customer [8:54] and we recommend response but we never [8:56] take that on their behalf. Second is [8:58] collaborate and in that mode we conduct [9:00] the full investigation but then we will [9:02] work with the customer and never take a [9:04] response without their direct [9:05] involvement. And the third is um [9:08] authorize and in that mode we are fully [9:10] authorized to take response actions on [9:13] behalf of customers and keep them [9:14] protected and we're comfortable [9:16] operating with customers in any of those [9:18] different different modes. And we [9:19] structured it that way so that we could [9:21] meet the customer where they are and [9:24] align our service with their level of [9:26] expertise and comfort level with us [9:28] taking response on their behalf. So all [9:30] of those same um principles apply to [9:33] agents as well as to humans. And the the [9:36] way that we handle automation and [9:38] response is you know we of course want [9:41] to ensure that we're responding quickly. [9:43] We also want to make sure that we're [9:45] using our analysts as efficiently as we [9:46] can, but we also recognize the need to [9:50] ensure that human judgment is applied [9:53] whenever there's potentially a [9:55] destructive response that an agent could [9:57] take. And so there's still anything that [9:59] we don't feel comfortable um you know [10:02] with an agent handling, we will pass off [10:04] for human judgment. So there's still a [10:06] lot of human judgment in the response [10:08] process even though there's [10:10] investigation even though the agents are [10:12] are automating a lot of the [10:13] investigations. [10:14] >> And how how do you see that that [10:16] evolving over time JP [10:21] >> excuse me I'm [10:24] a little bit tired after last night. [10:25] >> I think you're doing great. [10:27] >> Yeah. So the um the way that uh we see [10:30] it evolving is basically the the [10:32] response capabilities are going to [10:34] continue to to become more sophisticated [10:37] and we're going to continue to broaden [10:39] the series of use cases that we are [10:41] addressing with the agents that we've [10:42] built. But we're always going to have [10:44] humans at least at the moment I feel [10:46] like we're always going to have humans [10:47] supervising anything that could be [10:49] potentially destructive in a customer [10:50] environment. Um because at the end of [10:52] the day our mission one is keeping [10:54] customers protected and you know [10:56] operational. [10:57] >> So keep customers protected keep them [10:59] oper operational but also giving them [11:01] the control to decide whether that's [11:04] full authorization or notification only. [11:07] >> Exactly. Y [11:08] >> okay great. Um I suppose to to close [11:11] let's bring it back to the security [11:12] leaders that that we have here in the [11:14] room and um what would the the first [11:16] step to getting started with Sofas [11:18] really look like? [11:20] >> Yeah. Well, I I think the way that I [11:22] would um explain that is just in this [11:24] environment where the defender window is [11:26] closing, Frontier Intelligence is [11:28] accelerating, and the the capability of, [11:32] you know, relatively novice attackers to [11:34] make a real impact. Doing the [11:36] fundamentals well is more important than [11:38] it's ever than it really has ever been. [11:41] Um, and that means of course like having [11:42] patching programs to deal with the um [11:45] the vulnerabilities and the CVEes that [11:46] are being released by by many different [11:49] vendors and by the open source [11:50] community, but also making sure that you [11:52] have good fundamentals in place across [11:54] your infrastructure. So solid endpoint [11:56] protection like having having above [11:59] having the best endpoint protection is [12:01] more important than it's ever been. [12:03] Additionally, having, you know, basic [12:05] things like MFA in place across all of [12:08] your identity infrastructure, having [12:10] strong network segmentation in place, [12:12] and then having a strong security [12:13] operations program that wraps all of [12:16] that is more important than it's ever [12:17] been. And Sofos, we obviously we play in [12:19] all those different places. And um you [12:22] know, we're we would be happy to to talk [12:24] to anybody that's interested in learning [12:26] more. [12:26] >> So really, you're not saying to throw [12:29] out the fundamentals here and forget all [12:31] those basics. [12:32] >> I am not saying that. No. [12:33] >> Okay. [12:34] >> Yeah. And it's not it's not [12:35] controversial what I'm saying, I don't [12:36] think, but I think we get distracted by [12:38] the um the pace that the technology is [12:41] moving. Um you know, and of course we [12:44] want to we want to do everything that we [12:45] can to leverage agents to help help [12:48] security operations teams deal with the [12:51] increased workload, but also like [12:53] fundamentals fundamentals like endpoint [12:55] protection are just more important today [12:56] than they ever have been. [12:58] >> Yeah. [12:59] >> Thanks a million JP. It's been it's been [13:01] great chatting and I'm sure there's many [13:02] people in the audience who'd love to to [13:05] pick your brain this afternoon. So JP is [13:07] around. Um he will be here for the [13:09] remainder of the afternoon and available [13:10] if you want to buy him a drink at our [13:12] open bar shortly. Um but yeah, thanks a [13:15] million for your time JP. Um I'm going [13:18] to be uh leaving stage shortly, but uh [13:21] next up I'm delighted to introduce uh [13:23] Tom Duff Gordon who's OpenAI's policy VP [13:26] for AMIA. Thank you.