How Block is building AI-powered security with OpenAI technology

Block, the company behind Square, Cash App and Afterpay, is using OpenAI Daybreak and related systems across vulnerability discovery, detection and response. Results it reports include replaying a detection change against seven months of telemetry in under an hour, 18 minutes from a high-level vulnerability to an automated proposed patch in red-team exercises, roughly 600 analyst-hours per quarter of false-positive triage handed back, about 1,100 analyst-hours of investigation completed per quarter, and 50% boosts to triage and intelligence work.

CISO James Nettesheim describes AI as a scalable teammate for ambiguous problems, with humans validating results and gradually raising the risk level of systems AI is trusted to touch.

This is the defender story we want more of. Detection tuning that never happened because it took too long is now under an hour. Every alert getting a deep investigation instead of a glance is how you catch the campaign hiding inside a minor endpoint alert.

Nettesheim's gradual laddering of risk — prove judgment, then trust more sensitive systems — is the responsible adoption path. The red-team example of chaining a full attack path in about two hours shows the same tools that help defenders can also accelerate attackers; the race is real.

Caveat: these are Block's numbers from an OpenAI customer piece. We'd like to see them hold under peer review or independent case studies. And "proposed patch in 18 minutes" still needs a human to verify exploitability and ship the fix — Block says that's the process, and it should stay that way.

I'm watching whether smaller companies without Block's security bench get access to the same defender tooling, which Nettesheim says is the point.