Block Says OpenAI's Daybreak Cuts Security Work From Weeks to Hours

A new teammate for the security team

Block's security team uses what OpenAI calls the OpenAI Defense Factory, where AI handles vulnerability discovery, detection and response. Chief Information Security Officer James Nettesheim describes the approach as "having a new teammate that you can scale with." He contrasts it with traditional automation, saying the team can now prompt the system with "a fairly bespoke, ambiguous problem and work through it together."

Tasks such as reviewing a software bug or parsing a log used to take days or weeks. The team now completes them in a fraction of the time, according to the case study. For detection tuning, every investigation stores its raw query evidence, so the team can replay a proposed detection change against seven months of production telemetry in under an hour. That work used to mean requerying hundreds of old cases by hand, and it often did not happen because it took so long.

Block has also become more selective about models. "We used to use the latest model, but you don't need to do that anymore," Nettesheim says. The team built a security harness on top of Daybreak that routes tasks to the right model. It includes hooks for humans to take over tasks and for agents to verify each other's work. Block evaluates the system against internal benchmarks and real-world performance, and routes work to human review when that is the responsible path.

What the numbers show

The figures below come from Block and were published by OpenAI:

• 50% boost to triage throughput.
• 50% increase in intelligence gathering and investigations.
• Approximately 1,100 analyst-hours of investigation completed per quarter by a new autonomous hunting capability.
• Roughly 600 analyst-hours per quarter of false-positive triage handed back to the team.
• 18 minutes from submitting a high-level vulnerability to an automated proposed patch in recent red team exercises.

Nettesheim says the autonomous system gives every alert a full, deep investigation across all elements involved. "Our system works every alert like it's the only alert we've got that day," he says. The time saved on false positives now goes to deeper investigations and to building more automation responsibly.

Chaining attacks and fixing them

Traditional scanning tools flag a single vulnerability in isolation. According to the case study, Daybreak helps the team hypothesize about attack patterns and chain them into a full end-to-end compromise path, surfacing vulnerabilities that may have existed for years.

In one case, an alert on a single laptop looked like a minor policy issue. During peer review, the model followed an indicator that appeared only incidentally in the evidence and joined it against Block's identity logs, which revealed a much larger set of issues. "One routine endpoint alert became a campaign takedown," Nettesheim says.

In a recent red team exercise, the model was given a few hints about an internal system. It chained together SQL injection, privilege escalation, a foothold, credential enumeration and a pivot to other systems in about two hours. A human red teamer would typically need several days for that, according to the source.

For fixes, the team locates the issue in the code, identifies the owner, proposes a patch, confirms exploitability and verifies the fix, "with a human in the loop guiding it and deploying the code changes," Nettesheim says. Agents lack an organization's context and the reasoning behind earlier decisions, so people provide that layer. As AI's judgment is proven in practice, he says, "we'll slowly ladder up the risk level to use it for more sensitive systems."

What it means for defenders

Nettesheim argues that AI is compressing the time from human intent to action, and that the assumed attacker advantage of speed and agility is shrinking. With tools like Daybreak, he says, defenders can "fight fire with fire."

He also sees a chance to reduce the number of vulnerabilities introduced in the first place, which would let security teams spend less time patching and more on preventative, strategic work. He says these capabilities have typically been limited to very high-profile technology companies and governments, but that critical infrastructure, schools and small businesses can now start using the technology to defend their networks.