Block Leverages OpenAI’s Daybreak to Accelerate Security Operations

Block, the company behind Square, Cash App and Afterpay, has integrated OpenAI’s Daybreak model into its security operations to dramatically shorten response times.

The effort is branded the OpenAI Defense Factory, a framework where AI tackles vulnerability discovery, detection tuning and incident response at a scale no human team could sustain.

“AI is compressing the time from human intent to action.”

“For a while, it was assumed that there was an attacker advantage since they’re faster and more nimble.”

“But with things like Daybreak and the advancements in OpenAI’s tooling, defenders are able to fight fire with fire and keep up with the rapid pace of AI adoption.”

James Nettesheim, Block’s chief information security officer, describes the AI as a new teammate that can be scaled alongside human analysts.

“What it’s really centered on is having a new teammate that you can scale with,” he says.

“It’s not like a more traditional automation where you had to go step by step.”

“You can prompt it with a fairly bespoke, ambiguous problem and work through it together.”

Prior to AI assistance, reviewing a software bug or parsing a log could take days or weeks.

Now the same tasks finish in a fraction of that time, with a human still validating each output.

For detection tuning, the team can replay a proposed detection change against seven months of production telemetry in under an hour.

This contrasts with the previous manual process that required re‑querying hundreds of old cases by hand and was rarely performed because of its cost.

When proposing a patch, the system moves from a high‑level vulnerability description to an automated suggested patch in just 18 minutes.

The automated triage pipeline has reclaimed roughly 600 analyst‑hours per quarter that would otherwise be spent on false‑positive handling.

Investigations now consume about 1,100 analyst‑hours each quarter, all performed autonomously by the AI‑driven workflow.

Nettesheim notes, “This performs ~1,100 analyst‑hours of investigation per quarter, because every alert now gets a full, deep investigation across all elements the alert involves.”

He adds, “Our system works every alert like it’s the only alert we’ve got that day.”

Overall triage throughput has risen by 50 %, and intelligence‑gathering activities have also increased by 50 %.

The platform also introduces an autonomous hunting capability that continuously probes for hidden threats.

Block’s engineers have learned to match specific models to distinct tasks rather than defaulting to the newest release.

“We used to use the latest model, but you don’t need to do that anymore,” Nettesheim explains.

The security harness built on Daybreak routes tasks to the appropriate model and includes hooks for human takeover when necessary.

Continuous internal benchmarking ensures the system meets performance expectations and flags work for human review when required.

Traditional scanning tools typically flag single vulnerabilities in isolation.

Daybreak, however, can hypothesize attack chains, linking multiple findings into a full end‑to‑end compromise path.

In one incident, an alert on a single laptop that appeared to be a minor policy breach was expanded by the model into a multi‑stage attack scenario that had persisted for years.

This deeper insight enables Block to remediate systemic issues that would otherwise remain hidden.

The adoption of OpenAI technology reflects Block’s broader strategy to responsibly embed AI across its workflow, balancing speed with rigorous validation.

By automating repetitive analysis, the security team can devote more time to strategic threat modeling and proactive defense planning.

Why This Matters

Speeding Up Vulnerability Response

The integration of Daybreak compresses weeks‑long security tasks into minutes, allowing Block to remediate threats before they can be exploited.

Human‑AI Collaboration Model

Block’s approach treats AI as a scalable teammate, preserving human oversight while leveraging machine speed for routine analysis.

Broader Implications for the Industry

Block’s results demonstrate that large enterprises can achieve measurable efficiency gains by pairing specialized AI models with tailored security pipelines.