SentinelOne cuts malware analysis from weeks to hours
Quick Answer
SentinelOne leverages OpenAI's Daybreak to reduce malware reverse engineering time from weeks to hours, enabling broader investigations and deeper threat connections.
Quick Take
This advancement empowers more team members to handle security tasks, enhancing overall defense capabilities.
Key Points
- OpenAI's Daybreak enables malware analysis in about eight hours, down from four to six weeks.
- Faster analysis allows SentinelOne researchers to investigate more malware samples and uncover connections.
- Access to AI capabilities democratizes security expertise across SentinelOne's teams.
- Researchers can now map a larger malware landscape and adapt to evolving threats.
- Stewart emphasizes accountability remains a human responsibility despite automation.
DeepSignal Analysis
What happened
SentinelOne has significantly reduced the time required for malware reverse engineering from weeks to approximately eight hours by utilizing OpenAI's Daybreak. This advancement allows researchers to analyze more malware samples and identify connections between threats more effectively.
Key evidence
- Gregor Stewart, Chief AI Officer at SentinelOne, stated that traditional reverse engineering could take four to six weeks, while AI can now achieve similar results in about eight hours.
- The integration of OpenAI's capabilities enables SentinelOne's researchers to investigate a larger number of malware samples, enhancing their ability to identify relationships between different threats.
- Stewart noted that nearly all team members now have access to advanced cybersecurity tools, allowing them to take on security responsibilities that were previously limited to a small group of specialists.
Why it matters
This reduction in analysis time allows SentinelOne to keep pace with the evolving malware landscape, improving their threat detection and response capabilities. By enabling more team members to engage in security tasks, the company enhances its overall defense strategy and prepares for emerging threats more proactively.
📖 Reader Mode
~3 min readReverse engineering a sophisticated piece of malware can take a top security researcher four to six weeks. It’s painstaking work where researchers pull apart software to understand how it behaves, often retracing their steps as they uncover new information. Gregor Stewart, Chief AI Officer at SentinelOne, says OpenAI Daybreak can now produce human-level reverse-engineering output in roughly eight hours.
By reducing the time needed for deep analysis, OpenAI gives SentinelOne’s researchers room to investigate more malware and connect findings across samples. That wider view often reveals relationships that isolated investigations might miss. Stewart describes the opportunity as “a kind of intelligence that we were never able to afford before.”
“Something that would’ve taken a top-flight researcher four or six weeks to do, AI is now doing at human-level output in something like eight hours.”
—Gregor Stewart, Chief AI Officer, SentinelOne
Investigating more malware in less time
Daybreak gives defenders access to OpenAI models for cybersecurity work. SentinelOne uses these capabilities to reverse engineer malware, examining software to understand how it behaves. Faster analysis gives its researchers more capacity to investigate additional samples.
Stewart emphasizes that his team remains responsible for the outcome. “The only thing that can’t be automated is accountability,” he says. “Take a decision to change the architecture. This is something that still you would want human eyes on, whereas point fixes or things that don’t fundamentally change the way the software works, those might be better suited for automation,” he adds.
Seeing relationships across threats
Historically, research teams at SentinelOne had to reserve deep investigation for the most interesting or important threats they uncovered. “We were only able to reverse very small numbers of pieces of software,” Stewart says. With fewer samples to compare, they had fewer opportunities to spot connections between threats.
“Faster reverse engineering enables us to map a much larger part of the malware landscape and keep pace with how it changes. That gives our researchers a clearer picture of how threats are connected and how those relationships evolve.”
—Gregor Stewart, Chief AI Officer, SentinelOne
Faster analysis with Daybreak gives researchers more opportunities to compare malware samples and look for shared components. For example, a component found in two apparently unrelated samples could give researchers a lead to pursue during a customer investigation.
Comparing findings across more samples also reveals broader relationships between threats. Seeing those relationships, Stewart says, “would help you defend further out, and be more proactive about your defense.”
Empowering more teams to take on security work
Within SentinelOne, Stewart says access to OpenAI’s cyber capabilities is allowing more people to take responsibility for security work. “Almost everyone now has access to the kind of expertise that was in very short supply until maybe even a few months ago,” he says. More team members can investigate issues themselves rather than relying on a small group of specialists.
Stewart wants to bring OpenAI’s cyber capabilities into code creation, so SentinelOne developers can address security issues as they build.
“OpenAI is shifting the advantage to defenders by providing expert level cyber capability to everyone in the development team.”
—Gregor Stewart, Chief AI Officer, SentinelOne
— Originally published at openai.com
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from OpenAI Blog
See more →Scientific computing in the age of agentic AI
AI agents are transforming scientific computing by streamlining software development, enabling researchers to focus on discovery. Projects using Codex and Claude Code report accelerated development and improved maintenance, though challenges in validating AI outputs remain. Long-term stewardship of research software is crucial to ensure reliability and reproducibility.