According to an OpenAI announcement dated October 14, 2026, Block — the company behind Square, Cash App, and Afterpay — is using AI systems including OpenAI Daybreak to reduce the time its security team spends on vulnerability discovery, detection, and response. OpenAI describes the setup as the 'OpenAI Defense Factory.' Block's Chief Information Security Officer James Nettesheim is quoted describing the AI as 'a new teammate that you can scale with' rather than traditional step-by-step automation. The announcement reports a 50% boost to triage throughput, a 50% increase in intelligence gathering and investigations, and a new autonomous hunting capability. OpenAI cites figures of roughly 1,100 analyst-hours of investigation completed per quarter, about 600 analyst-hours per quarter handed back from false-positive triage, 18 minutes from submitting a high-level vulnerability to an automated proposed patch in recent red team exercises, and under an hour to replay a detection change against seven months of telemetry. Nettesheim states that a human still validates every result and guides deployment, with the team routing work to human review 'when that is the responsible path' and planning to 'slowly ladder up the risk level.' All figures are self-reported by OpenAI and Block via OpenAI's own channel.
What it means for you
A large payments company says it cut security investigation time from weeks to hours using AI — but the headline detail for operators is the operating model, not the tool. Block kept a person validating every result, routed different tasks to different models, and built in checkpoints where humans take over or agents verify each other. The reported time savings came from automating a well-understood, repetitive process (triage, log parsing, patch proposals), not from handing judgment to a machine. That's the lesson: AI pays off where the process is already clear, and a human stays on every decision that matters.
Try this
Pick one repetitive, time-consuming process your team does by hand — security triage, log review, invoice matching — and write down each step and who checks the result. Clarity on where a human must stay in the loop is the prerequisite for automating anything safely.
Who should care
Security and IT operations leaders at larger organizations, and anyone responsible for workflows that involve high-volume, repetitive review with real risk attached.
Skip this if
You don't run a security operations team or deal with high-volume alert triage. This is a vendor case study about one large company's custom build, not a product you can switch on, and the metrics are self-reported.
Sources: OpenAI — read the original