How Block is building AI-powered security with OpenAI technology
Block integrates OpenAI’s AI systems, including Daybreak, to accelerate vulnerability detection and response, cutting weeks-long tasks to hours while maintaining human oversight.
Block, the parent company of Square, Cash App, and Afterpay, has deployed AI systems such as OpenAI Daybreak through its OpenAI Defense Factory to automate vulnerability discovery, detection, and response at a scale exceeding human capacity. The security team now completes work that previously required weeks in hours, enabling faster remediation and deeper investigations. James Nettesheim, Chief Information Security Officer, describes the AI as a scalable teammate that can process ambiguous problems collaboratively, reducing manual steps in tasks like code review and log analysis.
The team has refined its model selection process, moving away from defaulting to the latest model for every task. Block’s security harness, built on Daybreak, routes tasks to the appropriate model and includes human verification hooks to ensure accuracy. Automated triage has increased throughput by 50%, boosted intelligence gathering and investigations by 50%, and introduced a new autonomous hunting capability. Nettesheim emphasizes the system’s ability to investigate every alert thoroughly, treating each as the only priority for the day.
Traditional scanning tools often isolate vulnerabilities, but Block’s AI can connect indicators across multiple logs to uncover broader attack patterns. In one instance, a minor endpoint alert led to the identification of a larger campaign after the AI linked incidental evidence to identity logs. During a red team exercise, Daybreak reconstructed a full attack path—including SQL injection and privilege escalation—within two hours, a process typically requiring days for human teams.
Nettesheim outlines the remediation workflow: locating the issue in code, identifying the owner, proposing a patch, confirming exploitability, and verifying fixes with human oversight. While AI handles much of the initial work, humans provide critical context and strategic direction. As AI proves reliable, Block plans to expand its use to more sensitive systems, aiming to reduce vulnerabilities introduced during development and shift security teams toward preventative strategies.