How Block is building AI-powered security with OpenAI technology

At Block, the company behind Square, Cash App, and Afterpay, the security team leverages the OpenAI Defense Factory: where AI handles vulnerability discovery, detection, and response at a scale that no human team could keep up with. With AI systems including OpenAI Daybreak, Block is taking just hours to do work that used to take weeks.

Block’s security team has been focused on responsibly adopting AI across workflows, whether that’s code generation or security operations. “What it’s really centered on is having a new teammate that you can scale with,” James Nettesheim, Chief Information Security Officer, says. “It’s not like a more traditional automation where you had to go step by step. You can prompt it with a fairly bespoke, ambiguous problem and work through it together.”

Projects like reviewing a software bug or parsing a log would take days or weeks to complete. Now the team can complete those projects in a fraction of the time, with a human still validating every result.

For example, for detection tuning, every investigation stores its raw query evidence, so the team can now replay a proposed detection change against seven months of production telemetry in under an hour. That work used to mean requerying hundreds of old cases by hand, and often it rarely happened in practice since it was so time-consuming.

The team has also gotten more particular about which model they’re using for which job. “We used to use the latest model, but you don’t need to do that anymore,” he says. “It’s been a learning experience to choose different models for different tasks.” Block’s security harness is built on top of Daybreak to help route tasks to the right model, and it includes hooks for humans to take over tasks or for agents to verify each other’s work. The team continually evaluates these systems against internal benchmarks and real-world performance, adjusting its approach when needed, including routing work to human review when that is the responsible path.

The automated triage system has resulted in faster work (and more of it) getting done. Block’s security team has seen a 50% boost to triage throughput, a 50% increase in intelligence gathering and investigations, and an entirely new autonomous hunting capability. Nettesheim says, “This performs ~1,100 analyst-hours of investigation per quarter, because every alert now gets a full, deep investigation across all elements the alert involves. Our system works every alert like it’s the only alert we’ve got that day.”

Traditional scanning tools flag a single vulnerability in isolation, but Block’s security team can go much further with Daybreak. The model helps hypothesize about attack patterns and chain together a series of attacks into a full end-to-end compromise path, surfacing vulnerabilities that might have existed for years.

In one case, an alert on a single laptop looked like a minor policy issue on its own. But during peer review, the model followed an indicator that appeared only incidentally in the evidence, joined it against Block’s identity logs, and surfaced a much larger set of issues. “One routine endpoint alert became a campaign takedown. No single tool makes that join. The signal only exists across two products’ logs,” James says.

Another example when Daybreak helped was during a recent red team exercise. The model was given a few hints about an internal system, and it chained together a full attack path—SQL injection, privilege escalation, a foothold, credential enumeration, and a pivot to other systems—in about two hours. This would typically take a human red teamer several days. In recent red team exercises, the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes.

Finding the vulnerabilities is only as good as the ability to fix them. Nettesheim walks through the process his team uses on every finding: locate where the issue lives in the code and identify who owns it, then move to remediation. “You propose a patch, you confirm exploitability, and then you verify that you have fixed it, with a human in the loop guiding it and deploying the code changes.”

While agents are technically capable, they don’t carry an organization’s context or the reasoning behind previous decisions. A human provides that context and strategy, and that’s where his team comes in to provide a human layer of review. As AI’s judgment is proven out in practice, Nettesheim says, “we’ll slowly ladder up the risk level to use it for more sensitive systems.”

Detection and response work alone has handed back roughly 600 analyst-hours per quarter that used to go toward triaging false positives. With that time back, the team now spends more time on deeper investigations and building more automation responsibly.

As the pace of attack increases and AI models keep advancing, Nettesheim sees an opportunity to reduce the number of vulnerabilities introduced in the first place. That would free security teams to spend less time patching and more time on preventative, strategic work.

“OpenAI is shifting the advantage to defenders by putting these advanced capabilities in everyone’s hands,” he says. “It’s typically only been in very high-profile technology companies and government hands. But everyone, including critical infrastructure, schools, small businesses, can now start utilizing this technology to defend their networks.”