Reported operating use · Cybersecurity managed services
Threat investigation, response planning and bounded execution
Sophos
Deployed Sophos MDR operations; reported 52% end-to-end case automation within analyst-calibrated authority boundaries.
A published third-party example, not a Nuvepro customer case or evidence of a partnership.
What the source reports
Sophos preserves Notify, Collaborate and Authorise service modes for human and agent work. Uncomfortable or potentially destructive work receives human oversight.
Reported technology: OpenAI Daybreak in Sophos Fusion / MDR. Scope and outcomes are source-reported.
What the enterprise environment would need
The following is a proposed project design for an enterprise doing similar work. Published details are marked; the remaining systems, data and scenarios would be agreed for your project.
- Systems and tools
- Inferred: native Fusion telemetry, threat intelligence and response APIs provide better substrate than recreated screens.
- Data and state
- Inferred: customer identity, indicators, investigation state and response state must remain consistent.
- People and handoffs
- Published modes define participation; inferred tests should exercise customer versus analyst ownership of each response.
- Rules and authority
- Published Notify/Collaborate/Authorise boundaries; inferred permission checks must be enforced below the model.
- Normal and exception cases
- Inferred: destructive action requests, missing context, benign alerts and adversarial evidence.
- Reset and replay
- Not published. Proposed: immutable telemetry cases, safe response stubs and no-effect replay.
A proposed simulation
An illustrative practice design derived from this work, not an executed assessment.
Resolve the same incident under Notify, Collaborate and Authorise modes, then inject uncertainty or a consequential action requiring review.
Review gate: Verify mode-specific authority, diagnosis, escalation and response outcome; compare time and error by case class.
Challenge the result: Keep the incident fixed and change only customer operating mode. The assessment must reject an otherwise effective response that exceeds the permitted authority.
What needs checking
- Published: Analyst-calibrated boundaries and human judgment for unsuitable actions; explicit independent testing protocol not disclosed.
- Proposed: Test unauthorized response prevention and missed-threat/false-positive outcomes with qualified reviewers.
- Published: Native customer data and operational service modes; no separate fidelity validation described.
- Proposed: Ensure simulated response and escalation behavior matches each contracted customer mode.
Review environment fidelity, human capability and agent performance separately. The enterprise’s accountable owners decide acceptance of the shared workflow and any operating use.
Shape this around your enterprise
Bring a similar workflow and the people responsible for it. Together, define the records and systems to use, the result your team will build or configure, and how its owners will check it. Nuvepro scopes the simulation, environment and preparation. Agree any existing-agent evaluation, implementation assistance and production responsibilities separately.
Sources and limitations
Curation review: . This is the date this source example was reviewed, separate from source publication dates.
- A matched-case independent accuracy comparison and customer-mode-specific failure distributions are not supplied.
- Sophos cuts threat investigation time by 96% with OpenAI DaybreakSource publication: 2026-10-09