Block uses OpenAI Daybreak to cut vulnerability patching to 18 minutes

Block, the company behind Square and Cash App, is leveraging the OpenAI Defense Factory and OpenAI Daybreak to accelerate security operations, reducing tasks that previously took weeks to hours. The integration allows the security team to handle vulnerability discovery, detection, and response at a scale that human teams could not previously match, effectively compressing the time from human intent to action.

Operational Efficiency Gains

The deployment of AI-driven workflows has yielded significant metrics in security operations:

• Patch Proposal Speed: In recent red team exercises, the time from submitting a high-level vulnerability to receiving an automated proposed patch dropped to 18 minutes.
• Detection Tuning: The team can now replay a proposed detection change against seven months of production telemetry in under one hour, a task that previously required manual requering of hundreds of cases.
• Investigation Volume: The system completes approximately 1,100 analyst-hours of investigation per quarter, ensuring every alert receives a deep, comprehensive review.
• Triage Improvement: There has been a 50% boost to triage throughput and a 50% increase in intelligence gathering, with roughly 600 analyst-hours per quarter handed back from false-positive triage.

Human-in-the-Loop Architecture

Block’s security harness is built on top of Daybreak to route tasks to the appropriate model, incorporating hooks for human oversight and agent-to-agent verification. While AI handles the heavy lifting of pattern recognition and initial patch generation, humans remain responsible for validating results, providing organizational context, and approving deployments. James Nettesheim, Block’s Chief Information Security Officer, notes that the team is learning to select specific models for specific tasks rather than relying solely on the latest version, ensuring responsible adoption across workflows.

Strategic Impact

The ability to chain attack paths and surface end-to-end compromise scenarios has transformed Block’s defensive posture. For instance, a routine endpoint alert was escalated into a campaign takedown by joining incidental indicators across multiple product logs. By automating the detection and initial remediation phases, Block aims to shift security resources from reactive patching to preventative, strategic work, ultimately reducing the number of vulnerabilities introduced in the first place.