How Block is building AI-powered security with OpenAI technology
- ID
- 35590
- Status
- summarized
- Published
- 14 Oct 2026, 3:00 PM
- Fetched
- 15 Oct 2026, 7:34 AM
- Provider
- OpenAI News
- Category
- ai-labs
- Original URL
- https://openai.com/index/block-ai-powered-security
- Source URL
- https://openai.com/news/rss.xml
Summary
- Score
- 4.0
- Created
- 15 Oct 2026, 7:34 AM
- Tags
- Audience
- developersai_ml_learnersai_agent_userssaas_founders
What happened
OpenAI published a customer case study describing how Block (Square, Cash App, Afterpay) uses its Defense Factory stack, including a system called OpenAI Daybreak, across vulnerability discovery, detection tuning and response. The concrete claims: replaying a proposed detection change against seven months of production telemetry takes under an hour (previously manual requerying of hundreds of old cases that often didn't happen), an automated proposed patch arrives 18 minutes after submitting a high-level vulnerability, roughly 600 analyst-hours per quarter are handed back from false-positive triage, and about 1,100 analyst-hours of investigation run per quarter. Block CISO James Nettesheim is quoted saying the team now picks different models for different tasks rather than always using the latest one, and that a human still validates every result.
Why it matters
There is no product, price, availability or methodology here — it's a vendor case study, so you cannot benchmark your own team against these numbers or buy Daybreak off the shelf. The one transferable engineering detail is the pattern, not the vendor: because every investigation stores its raw query evidence, a proposed detection change can be replayed against seven months of telemetry in under an hour. If you run agents over logs or telemetry, retaining raw query evidence at write time is what makes that kind of back-testing possible later. The second detail, choosing different models per task instead of defaulting to the newest, is worth testing on your own workloads, but treat Block's hours-saved figures as unaudited vendor claims.
Discussion angle
The 600 analyst-hours per quarter and the 18-minute patch figures are self-reported by the vendor with no baseline, sample size or failure-rate data. What evidence would you actually want before signing off on an AI security workflow — replayable back-tests, false-negative rates, or a paid pilot with your own telemetry?