SentinelOne says OpenAI Daybreak cuts malware reverse engineering to hours

Weeks of work reduced to about eight hours

Reverse engineering a sophisticated piece of malware is slow, painstaking work. Researchers pull apart software to understand how it behaves, and they often have to retrace their steps as new information appears. According to the source, this can take a top security researcher four to six weeks.

Stewart, SentinelOne's Chief AI Officer, says OpenAI Daybreak now produces human-level output for this kind of work in roughly eight hours. In his words: "Something that would’ve taken a top-flight researcher four or six weeks to do, AI is now doing at human-level output in something like eight hours." He describes the opportunity as "a kind of intelligence that we were never able to afford before."

Daybreak gives defenders access to OpenAI models for cybersecurity work. SentinelOne uses these capabilities to reverse engineer malware, which gives its researchers capacity to investigate additional samples.

Human accountability stays in place

Stewart stresses that his team remains responsible for the outcome. "The only thing that can’t be automated is accountability," he says.

He draws a line between types of changes. A decision to change the architecture is something he would still want human eyes on. Point fixes, or changes that do not fundamentally alter the way the software works, "might be better suited for automation," he adds.

Mapping connections between threats

Historically, SentinelOne's research teams had to reserve deep investigation for the most interesting or important threats they found. "We were only able to reverse very small numbers of pieces of software," Stewart says. With fewer samples to compare, there were fewer chances to spot connections between threats.

Faster analysis changes that, according to Stewart. Researchers can compare more malware samples and look for shared components. The source gives one example: a component found in two apparently unrelated samples could give researchers a lead to pursue during a customer investigation. Comparing findings across more samples also reveals broader relationships between threats.

Stewart says seeing those relationships "would help you defend further out, and be more proactive about your defense." He adds that faster reverse engineering lets the company "map a much larger part of the malware landscape and keep pace with how it changes."

Security work for more of the team

Stewart also says access to OpenAI's cyber capabilities is allowing more people inside SentinelOne to take responsibility for security work. "Almost everyone now has access to the kind of expertise that was in very short supply until maybe even a few months ago," he says. More team members can investigate issues themselves rather than relying on a small group of specialists.

Looking ahead, Stewart wants to bring these capabilities into code creation, so SentinelOne developers can address security issues as they build. He argues that "OpenAI is shifting the advantage to defenders by providing expert level cyber capability to everyone in the development team."

The figures and claims come from SentinelOne's own account of its use of Daybreak, as described by its Chief AI Officer. The source does not provide independent benchmarks or details on pricing or availability.