Block, the company behind Square and Cash App, has integrated OpenAI's Daybreak to dramatically accelerate its security operations, reducing response times from weeks to hours. The initiative has already boosted the security team's triage throughput by 50%.
TL;DR
- Block leverages OpenAI Daybreak to automate vulnerability discovery and response, cutting response times from weeks to hours.
- The integration has resulted in a 50% boost in triage throughput and a 50% increase in intelligence gathering and investigations.
- Block's security team uses a combination of AI and human expertise to validate and act on the findings, with humans guiding the process and deploying code changes.
What happened
Block has integrated OpenAI's Daybreak into its security operations, enabling the team to compress the time from vulnerability discovery to response from weeks to hours. The AI systems handle vulnerability discovery, detection, and response at a scale that no human team could match.
The integration has resulted in a 50% boost in triage throughput, a 50% increase in intelligence gathering and investigations, and an entirely new autonomous hunting capability. The team has also seen a significant reduction in false positives, with roughly 600 analyst-hours per quarter handed back from false-positive triage.
Block's security team uses a combination of AI and human expertise to validate and act on the findings. The team continually evaluates these systems against internal benchmarks and real-world performance, adjusting its approach when needed, including routing work to human review when that is the responsible path.
Why it matters
The integration of AI into Block's security operations demonstrates the potential for AI to shift the advantage to defenders in the cybersecurity landscape. By automating routine tasks, the security team can focus on more strategic work, such as deeper investigations and building more automation responsibly.
The initiative highlights the importance of choosing the right model for the right task. Block's security harness is built on top of Daybreak to help route tasks to the right model, and it includes hooks for humans to take over tasks or for agents to verify each other's work.
The integration of AI into security operations is not without its challenges. While AI can handle routine tasks at scale, it lacks the organizational context and reasoning behind previous decisions. As AI's judgment is proven out in practice, the security team will slowly ladder up the risk level to use it for more sensitive systems.
Key facts
- Block's security team uses OpenAI Daybreak to compress the time from vulnerability discovery to response from weeks to hours.
- The integration has resulted in a 50% boost in triage throughput and a 50% increase in intelligence gathering and investigations.
- The team has seen a significant reduction in false positives, with roughly 600 analyst-hours per quarter handed back from false-positive triage.
- The team completes approximately 1,100 analyst-hours of investigation per quarter, with every alert receiving a full, deep investigation.
- In recent red team exercises, the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes.
- Block's security team uses a combination of AI and human expertise to validate and act on the findings, with humans guiding the process and deploying code changes.
- The team continually evaluates these systems against internal benchmarks and real-world performance, adjusting its approach when needed.
- Block's security harness is built on top of Daybreak to help route tasks to the right model, and it includes hooks for humans to take over tasks or for agents to verify each other's work.
Context
The integration of AI into security operations is a growing trend in the cybersecurity landscape. As AI models advance, they are increasingly being used to automate routine tasks, freeing up security teams to focus on more strategic work.
The use of AI in security operations is not without its challenges. While AI can handle routine tasks at scale, it lacks the organizational context and reasoning behind previous decisions. As AI's judgment is proven out in practice, security teams will need to carefully consider when and how to use AI for more sensitive systems.
The integration of AI into security operations is part of a broader trend towards the responsible adoption of AI across workflows. As AI models advance, they are increasingly being used to automate routine tasks, freeing up teams to focus on more strategic work.
