Block — the company behind Square, Cash App and Afterpay — has integrated artificial intelligence into its security operations to reduce the time needed for detection, investigation and remediation. Using an internal “OpenAI Defense Factory” and models including OpenAI Daybreak, the security team says it can now complete work in hours that previously required weeks. James Nettesheim, Chief Information Security Officer at Block, describes the AI as “a new teammate” that can be scaled while humans validate every result.
Where AI is applied
Block applies AI to vulnerability discovery, detection tuning, triage and response. The team chooses models based on task type rather than always using the newest model; their security harness routes work to the most appropriate model and provides hooks for human takeover or cross-agent verification. Systems are continuously evaluated against internal benchmarks and real-world performance, and tasks are routed to human review when responsible.
Measurable time and capacity savings
- For detection tuning, the team can replay a proposed detection change against seven months of production telemetry in under an hour. Previously this required manually requerying hundreds of old cases and was rarely done because of the time cost.
- In recent red team exercises, the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes.
- The system now performs roughly 1,100 analyst-hours of investigation per quarter because every alert receives a full, deep investigation.
- Automation in detection and response has returned about 600 analyst-hours per quarter that had been spent triaging false positives.
- Triage throughput has increased by 50%, and intelligence gathering and investigations have also increased by 50%, alongside a new autonomous hunting capability.
How it works in practice
The models can do more than flag single, isolated vulnerabilities: they help hypothesize attack patterns and chain multiple steps into end-to-end compromise paths. In one instance, what appeared to be a routine endpoint alert on a single laptop was expanded during peer review when the model followed an incidental indicator, linked it with Block’s identity logs, and surfaced a far larger set of issues. The relevant signal only existed when logs from two different products were joined.
Another example came from a red team exercise where Daybreak, given a few hints about an internal system, chained together a full attack path — SQL injection, privilege escalation, establishing a foothold, credential enumeration and pivoting to other systems — in about two hours. A human red teamer would typically need several days for that work.
Fixing issues and the human role
Finding vulnerabilities is only useful if they can be fixed. Block’s process on each finding is to locate the issue in code, identify ownership, propose a patch, confirm exploitability, and then verify the fix with a human in the loop who guides and deploys the code changes. While agents can operate technically, they lack organizational context and the rationale behind prior decisions, so human reviewers remain responsible for context, strategy and higher-risk systems.
Nettesheim says that as AI judgment proves reliable in practice, Block will gradually increase the level of risk for which models are trusted to act autonomously, always aligned with responsible oversight.
Why this matters
Block’s experience shows that AI can shift time away from routine triage and toward preventive and strategic security work. Nettesheim argues that technologies like OpenAI’s models can put advanced defensive capabilities into broader hands — not only large tech firms and governments, but also critical infrastructure operators, schools and small businesses — potentially improving defenses across the ecosystem.
Summary of results
- Under 1 hour to replay a proposed detection change against seven months of telemetry
- 18 minutes from high-level vulnerability submission to automated proposed patch in red team exercises
- ~1,100 analyst-hours per quarter of investigations completed
- ~600 analyst-hours per quarter returned from triaging false positives
- 50% increase in triage throughput and in intelligence gathering / investigations
Block’s approach integrates AI to accelerate and scale security operations while preserving human oversight and organizational context.
