{"slug": "block-taps-openai-to-speed-up-threat-hunting-while-humans-keep-the-final-say", "title": "Block taps OpenAI to speed up threat hunting while humans keep the final say", "summary": "Block, the parent of Square, Cash App and Afterpay, reported that its OpenAI-built security orchestration system Daybreak automates roughly 1,100 analyst-hours of investigative work per quarter, according to a case study published October 14, 2026. Block said triage throughput and intelligence gathering each rose about 50%, the system recovered approximately 600 analyst-hours previously spent triaging false positives, and in red-team exercises Daybreak chained full attack paths in about 2 hours, produced a proposed patch in 18 minutes, and replayed 7 months of telemetry in under 1 hour. Block said humans verify findings and deploy changes, so no remediation reaches production on the model's say-so.", "body_md": "# Block taps OpenAI to speed up threat hunting while humans keep the final say\n\nThe Square and Cash App parent says its OpenAI-built Daybreak system automates about 1,100 analyst-hours of investigations every quarter\n\nBlock, the company behind Square, Cash App, and Afterpay, has brought [OpenAI](https://cryptobriefing.com/markets/openai/)’s technology into the core of its security operations.\n\nThe details come from a case study published on October 14, 2026. It describes a custom security orchestration system called Daybreak, which Block developed in partnership with OpenAI.\n\n## What Daybreak actually does\n\nAccording to the case study, Daybreak automates three of the most labor-intensive jobs in a security team: vulnerability discovery, threat detection, and incident response.\n\nIt works by linking security signals that would otherwise sit in separate silos. It also simulates attack paths, which means it maps how an intruder could move from one weakness to the next.\n\nThe workflow has a clear boundary. The AI handles signal correlation and drafts issues for the team. Humans verify the findings and deploy any changes.\n\n## The numbers behind the pitch\n\nBlock reports efficiency gains that would get any security leader’s attention.\n\nTriage throughput rose by roughly 50%. The volume of intelligence gathering and investigations climbed by about the same margin.\n\n### AI, tech, and the markets they move—in one daily briefing.\n\nDaily. Free. Join 34,000+ readers across crypto, finance, and policy.\n\nThe system now automates around 1,100 analyst-hours of investigative work per quarter.\n\nBlock also says it recovered approximately 600 analyst-hours that had been spent triaging false positives.\n\nIn red-team exercises, Daybreak completed full attack-path chaining in approximately 2 hours. It produced a proposed patch in 18 minutes.\n\nIt also replayed telemetry covering 7 months of data in less than 1 hour.\n\n## Why the human-in-the-loop design matters\n\nThe 18-minute patch figure deserves to be read in context. It is a proposed patch, not a deployed one. The remediation clock still includes the time it takes a person to confirm the fix is correct and safe.\n\nNothing goes into production on the model’s say-so. For a company that moves money for merchants and consumers, that guardrail is the whole point.\n\n## What this means for fintech and security spending\n\nThe research accompanying the case study suggests firms that adopt similar AI tools may see notable cost savings and stronger security outcomes, and investors could come to view those firms as more resilient against cyber threats.\n\nThe efficiency numbers are Block’s own reported figures from its own environment. Other companies with different tooling, data quality, and team structures may not see the same results.\n\n**Disclosure:** This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our\n\n[Editorial Policy](https://cryptobriefing.com/editorial-policy/).", "url": "https://wpnews.pro/news/block-taps-openai-to-speed-up-threat-hunting-while-humans-keep-the-final-say", "canonical_source": "https://cryptobriefing.com/block-openai-daybreak-security-operations/", "published_at": "2026-10-19 16:57:53+00:00", "updated_at": "2026-10-19 17:17:47.763526+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-safety", "ai-products"], "entities": ["Block", "OpenAI", "Daybreak", "Square", "Cash App", "Afterpay", "Diego Almada Lopez"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/block-taps-openai-to-speed-up-threat-hunting-while-humans-keep-the-final-say", "markdown": "https://wpnews.pro/news/block-taps-openai-to-speed-up-threat-hunting-while-humans-keep-the-final-say.md", "text": "https://wpnews.pro/news/block-taps-openai-to-speed-up-threat-hunting-while-humans-keep-the-final-say.txt", "jsonld": "https://wpnews.pro/news/block-taps-openai-to-speed-up-threat-hunting-while-humans-keep-the-final-say.jsonld"}}