Block Uses OpenAI Tech to Build AI-Powered Security
Block, the company behind Square, Cash App, and Afterpay, is transforming its cybersecurity operations by integrating OpenAI technology to accelerate threat investigation and patch generation.
Radwan AbdulhadiEditor and technology writer
Transforming Security Operations with OpenAI
Block, the parent company of Square, Cash App, and Afterpay, has integrated advanced artificial intelligence systems into its security workflows. By leveraging the OpenAI Defense Factory, Block's security team is handling vulnerability discovery, detection, and response at a scale that exceeds traditional human capacity. The company utilizes tools including OpenAI Daybreak to compress the time required to fix vulnerabilities, allowing security professionals to dedicate more time to strategic initiatives. Further details are available from OpenAI News in the original source material.
James Nettesheim, Chief Information Security Officer at Block, described the implementation as introducing a scalable new teammate rather than relying on standard step-by-step automation. According to Nettesheim, the AI allows operators to prompt it with bespoke, ambiguous problems and work through them collaboratively. Projects that previously required days or weeks—such as reviewing software bugs or parsing logs—are now completed in a fraction of the time, with human operators continuing to validate every result. Further details are available from Contact sales in the original source material.
Faster Triage and Telemetry Replay
The adoption of automated triage systems has yielded significant performance gains across Block's security operations. The team has recorded a 50% boost to triage throughput alongside a 50% increase in intelligence gathering and investigations. Additionally, the setup enables an entirely new autonomous hunting capability that performs roughly 1,100 analyst-hours of investigation per quarter by deeply examining every alert.
Furthermore, detection tuning has been streamlined. Because every investigation stores raw query evidence, the security team can now replay a proposed detection change against seven months of production telemetry in under an hour. Previously, this process required manually requerying hundreds of old cases, a time-consuming task that was rarely performed in practice.
In addition to detection and response improvements, approximately 600 analyst-hours per quarter of false-positive triage have been returned to the team. This recovered time allows security analysts to concentrate on deeper investigations and the responsible development of further automation.
Model Routing and Advanced Threat Hunting
Block's security harness is constructed on top of Daybreak to route specific tasks to appropriate models. The architecture incorporates hooks that enable humans to take over tasks or allow agents to verify each other's work. The team evaluates these systems continuously against internal benchmarks and real-world performance, adjusting their approach when necessary and routing work to human review when responsible.
While traditional scanning tools flag single vulnerabilities in isolation, Block's security team uses Daybreak to hypothesize about attack patterns and chain together series of attacks into comprehensive end-to-end compromise paths. In one instance, a routine endpoint alert on a single laptop was correlated with identity logs during peer review, turning an isolated policy issue into a major campaign takedown.
Accelerating Red Team Exercises and Remediation
The capabilities of the AI-powered security harness were also demonstrated during a recent red team exercise. Given a few hints about an internal system, the model chained together an entire attack path—incorporating SQL injection, privilege escalation, a foothold, credential enumeration, and lateral movement—in approximately two hours. For human red teamers, this process typically takes several days.
During recent red team exercises, the elapsed time from submitting a high-level vulnerability to producing an automated proposed patch reached 18 minutes. Nettesheim explains that the remediation workflow involves locating the issue in the code, identifying its owner, proposing a patch, confirming exploitability, and verifying the fix with a human guiding and deploying the code changes.
While AI agents are technically capable, Nettesheim notes that they lack organizational context and the historical reasoning behind past decisions. Consequently, the human layer of review remains essential for strategy and governance, with plans to gradually expand AI usage to more sensitive systems as judgment is proven in practice.
Shifting the Advantage to Defenders
Looking ahead, Nettesheim anticipates opportunities to reduce the number of vulnerabilities introduced initially, allowing security teams to spend less time patching and more time on preventative and strategic measures as attack paces quicken.
Concluding on the broader industry impact, Nettesheim emphasizes that OpenAI is shifting the advantage toward defenders. By putting advanced capabilities into the hands of organizations beyond high-profile technology firms and governments, critical infrastructure, schools, and small businesses can better utilize technology to defend their networks.
Sources
- OpenAI NewsHow Block is building AI-powered security with OpenAI technology
Continue chronologically
Related entity coverage
Related stories
Jack Dorsey's Block Reveals Human-Like Voice Model Called Dessa
Block has introduced Dessa, a full-duplex speech model trained entirely on human speech that can run locally on consumer hardware like a MacBook M4 Max.
Jack Dorsey’s Block Announces Dessa AI Voice Model
Jack Dorsey’s Block has introduced Dessa, a new speech-to-speech AI model trained entirely on human conversation that runs locally on local hardware.
OpenAI Prepares New Security Sprint With Cathedral Systems
OpenAI announces its next internal security sprint in partnership with Cathedral Systems to test and strengthen its AI defenses and systems.
Third Moment Research Runs 10,000 AI Agents for 36+ Hours
Discover how Third Moment Research uses OpenAI models like GPT-6 Astra and Codex to run thousands of autonomous AI agents for days.
