Block, the company behind Square, Cash App, and Afterpay, is using OpenAI's Daybreak model and the OpenAI Defense Factory to speed up security work. Chief Information Security Officer James Nettesheim says the AI compresses the time from human intent to action, allowing defenders to keep pace with attackers who were assumed to be faster and more nimble.
Concrete results include detection tuning that used to mean requerying hundreds of old cases by hand; the team can now replay a proposed detection change against seven months of production telemetry in under an hour. In recent red team exercises, the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes. Block also reports roughly 600 analyst-hours per quarter of false-positive triage handed back and approximately 1,100 analyst-hours of investigation completed each quarter, alongside a 50% boost to triage throughput.
Humans remain in the loop. Nettesheim says the team chooses different models for different tasks rather than always using the latest one, and the harness includes hooks for humans to take over or for agents to verify each other's work. In one case, a routine endpoint alert was joined against identity logs during peer review and became a campaign takedown. As AI's judgment is proven in practice, Block plans to slowly ladder up the risk level for more sensitive systems.