Sophos and Proofpoint integrate OpenAI GPT cyber models to supercharge threat triage and managed risk

Marijan Hassan - Tech Journalist

2 days ago

2 min read

Cybersecurity leaders Sophos and Proofpoint have separately announced major integrations of OpenAI’s specialized GPT cyber models into their flagship security operations and vulnerability management platforms.

Leveraging OpenAI’s Daybreak Defense Network, both vendors aim to transform how security analysts and enterprise defenders validate threats, moving away from static vulnerability scores toward real-time, evidence-backed exploit analysis.

Sophos Builds Exploit Path Verification into Managed Risk

Sophos is incorporating OpenAI’s frontier cyber models into its Sophos Managed Risk service through a new feature dubbed Exploit Path Verification (EPV). The capability addresses a fundamental bottleneck in modern vulnerability management: security teams drowning in endless lists of critical Common Vulnerabilities and Exposures (CVEs) without knowing which flaws are actually accessible to threat actors.

Rather than prioritizing patches solely by generic CVSS severity scores, EPV combines OpenAI’s cyber reasoning models with telemetry from a customer’s specific environment, including asset state, endpoint protection policies, network reachability, identity privileges, and known exploit availability.

The integration delivers clear, evidence-backed verdicts to defenders:

Confirmed exploitable: Evidence proves an active attack path exists from an external exposure to internal assets.
Blocked by a control: A security control successfully mitigates the vulnerability, removing immediate patching urgency.
Chained vulnerabilities: EPV identifies complex attack routes where multiple lower-severity flaws are chained together to achieve full system compromise.
Automated remediation scripting: The engine automatically drafts tailored remediation instructions ready for deployment via internal ticketing systems.

Proofpoint Accelerates Incident Investigations with AI Agents

Concurrently, Proofpoint is embedding OpenAI’s GPT cyber models into its security operations workflow to streamline incident investigations across email, identity, and data loss prevention (DLP) domains.

The integration introduces natural language investigation capabilities, allowing analysts to query complex security telemetry, automate recurring threat hunting exercises, and correlate multi-vector attacks in seconds. Crucially, Proofpoint emphasized a "human-in-the-loop" operational boundary: while the AI models aggregate context and generate evidence-linked recommendations, the platform requires human analyst approval before executing consequential containment actions or account modifications.

Operationalizing AI Models Under OpenAI's Daybreak Network

Both integrations stem from Sophos and Proofpoint joining OpenAI’s Daybreak Defense Network (formerly the Daybreak Cyber Partner Program). The framework enables vetted security vendors to deploy OpenAI's frontier reasoning models within defensive operations under strict safeguards, including identity verification, defined testing scopes, and comprehensive audit logging.

By pairing OpenAI’s advanced reasoning capabilities with live environmental data, Sophos and Proofpoint are positioning AI-driven validation as a core standard for enterprise risk management, helping defenders prioritize actionable threats over passive security noise.