Sophos MDR achieves 89-second threat response with AI-powered agentic SOC defending 40,000 customers

Sophos MDR Sets New Benchmark with 89-Second Threat Response

Sophos has announced production results from twelve months of agentic operation inside Sophos Managed Detection and Response (MDR), revealing a dramatic shift in how Security Operations Center infrastructure handles cyber threats at scale1

1

2

2

. The platform now defends 40,000 customers worldwide, marking 39% growth year-over-year, while achieving threat neutralization in just 89 seconds from case creation to fully automated response2

2

. This metric measures how fast the Sophos Central Defense System acts on cases AI is authorized to resolve, translating directly into faster response against attacks that move at machine speed. The 89-second threat response represents a significant acceleration in cybersecurity threat response capabilities, addressing the structural imbalance between cybersecurity demand and available expertise that has outpaced what traditional SOC structures can manage1

1

.

AI Handles 52% of Cases End-to-End in Agentic SOC Model

The production data reveals that AI now closes 52% of Sophos Managed Detection and Response cases end-to-end without human intervention, operating within boundaries continuously calibrated by analysts2

2

. This metric measures the volume of work AI is doing autonomously, not just alert triage or threat containment. Sophos operates both a human-on-the-loop (HOTL) and human-in-the-loop (HITL) model within the agentic SOC: human-on-the-loop for high-volume, well-bounded work where speed matters, and human-in-the-loop for high-stakes decisions where context, business impact, or novel adversary behavior require analyst judgment before action[2](https://cxotoday.com/cybersecurity/sophos-l aunches-agentic-soc-reducing-cybersecurity-threat-response-to-89-seconds/). AI now handles the volume that previously consumed Tier 1 and much of Tier 2 analyst time, while human analysts have shifted to higher-value work including threat hunting, investigation, customer advisory, and governance of the autonomous systems themselves1

1

.

Sophos Central Defense System Powers Unified Threat Detection and Response

Through Sophos Central, described as the industry's first AI-Native Cybersecurity Defense System, endpoint, firewall, identity, SIEM, network, email, cloud, threat intelligence, and MDR share a unified context lake, integrated AI, and a single workflow1

1

. Open by design, it supports 350+ third-party integrations and delivers one of the most complete solutions for Microsoft environments. Behind every Sophos MDR case is a Defense System that ingests tens of millions of detections daily, suppresses noise, correlates signals, and surfaces only what warrants action2

2

. The result is a sharply narrowed window where AI and human judgment are deployed against threats and the right response is delivered by the right responder. Raja Patel, president of Sophos, stated: "When you run the world's largest SOC, every threat encountered makes every customer's defense stronger. No other vendor operates with our breadth, from small businesses to global enterprises with tens of thousands of employees, and no other vendor compounds intelligence across that scale"1

1

.

Industry Recognition Validates Automation Approach to Threat Neutralization

Sophos has secured recognition across multiple industry analyst reports for its approach to threat detection and response. The company was named a 2026 Gartner Peer Insights Customers' Choice in the Voice of the Customer for Managed Detection and Response, achieving an overall rating of 4.8 out of 5.0 based on 290 reviews, making Sophos the most-reviewed vendor in the report1

1

. KuppingerCole Analysts recently named Sophos an Overall Leader in the Leadership Compass for MDR, with leadership positions in four categories: Overall Leadership, Product Leadership, Innovation Leadership, and Market Leadership1

1

. Additionally, Sophos was ranked #1 across five categories in G2 Summer 2026 Reports, named the top overall solution in Endpoint Protection, EDR, XDR, MDR, and Firewall based entirely on verified customer reviews2

2

. This marks the eighth consecutive quarter that Sophos MDR has been named the overall leader, with no other vendor in the cybersecurity industry achieving this across all five categories in a single season. Rob Harrison, SVP product management at Sophos, emphasized: "When AI takes the volume off the human queue, our analysts get the bandwidth to do the work that requires their judgment: the novel attack patterns, the high-stakes decisions, the cases where context and business implications matter"2

2

.🟡 analogies=🟡The images selected are highly relevant to the story’s content. Image 'ar-141185' effectively symbolizes cybersecurity threats and protection, aligning perfectly with the article's discussion of Sophos MDR's threat response capabilities. It is placed after the introductory paragraph that highlights the dramatic shift in handling cyber threats.

Image 'ar-141184' graphically represents "Sophos Managed Detection and Response" and subtly hints at human involvement in a security operations center, which is directly relevant to the section on AI handling cases with human-on-the-loop and human-in-the-loop models. This image is placed after the paragraph describing how AI handles a significant percentage of cases, enhancing the visual connection to the product and the hybrid operational model.

The placement of images follows the rules by not being directly after one another and being strategically positioned after the most relevant paragraphs. The chosen images uphold the story's overall tone and enhance the reader's comprehension without disrupting the flow of information.