Block's Security Team Goes from Weeks to Hours with OpenAI Daybreak!

Hi everyone, it's Shii-chan! Today I'm sharing a reassuring story about defenders getting a big speed-up from AI.

OpenAI News openai.com

What was announced?

OpenAI News published a case study on the security team at Block, the company behind Square, Cash App, and Afterpay. Block uses the OpenAI Defense Factory, where AI handles vulnerability discovery, detection, and response, with AI systems including OpenAI Daybreak. Work that used to take weeks now takes hours.

Why it matters

AI makes attackers faster, so defenders have to keep up. CISO James Nettesheim says tools like Daybreak let defenders fight fire with fire.

What matters is that humans stay in the loop. Reviewing a bug or parsing a log used to take days or weeks, and now takes a fraction of the time, with a human validating every result.

What changes

• Deep investigation of every alert: each alert is investigated across all the elements it involves
• Practical detection tuning: every investigation stores its raw query evidence, so a proposed detection change can be replayed against seven months of production telemetry in under an hour (before, that meant requerying hundreds of old cases by hand, which rarely happened)
• Less false-positive work: roughly 600 analyst-hours per quarter handed back

Dive Deep

Model routing and safeguards

Block no longer just uses the latest model for everything. Its security harness, built on top of Daybreak, routes tasks to the right model. It includes:

• Hooks for humans to take over tasks
• Hooks for agents to verify each other's work

The team keeps evaluating the system against internal benchmarks and real-world performance, and routes work to human review when that is the responsible path.

Results at a glance

• Replaying a proposed detection change against seven months of telemetry: under one hour
• From a high-level vulnerability report to an automated proposed patch: 18 minutes in recent red team exercises
• False-positive triage handed back: roughly 600 analyst-hours per quarter
• Investigation completed: approximately 1,100 analyst-hours per quarter
• Triage throughput: up 50%
• Intelligence gathering and investigations: up 50%
• A new autonomous hunting capability

Examples

• Chaining attack paths: traditional scanners flag one vulnerability in isolation, but Daybreak hypothesizes attack patterns and chains them into end-to-end compromise paths, sometimes surfacing vulnerabilities that existed for years
• One laptop alert: it looked like a minor policy issue, but during peer review the model followed an indicator that appeared only incidentally, joined it against identity logs, and uncovered a much larger set of issues. In James's words, "one routine endpoint alert became a campaign takedown"
• A red team exercise: given a few hints about an internal system, the model chained SQL injection, privilege escalation, a foothold, credential enumeration, and a pivot in about two hours. A human red teamer would typically need several days

Fixing with humans in the loop

After discovery, the team locates the issue in the code, identifies the owner, and moves to remediation: propose a patch, confirm exploitability, and verify the fix, with a human guiding it and deploying the changes. Agents don't carry an organization's context or the reasoning behind past decisions, so humans add that layer of review. As AI's judgment is proven in practice, the team plans to gradually raise the risk level it is used for.

Wrap-up

• Block's security team uses the OpenAI Defense Factory and Daybreak to speed up discovery, detection, and response
• Triage throughput is up 50%, with about 1,100 analyst-hours of investigation per quarter
• In red team exercises, the time from report to proposed patch was 18 minutes
• Safeguards include human validation, per-task model routing, and agents verifying each other

This is for anyone buried under a mountain of security alerts!