Finance / Payments
Block: Automating the security team's detection tuning, alert investigation and vulnerability remediation
- Company
- Block
- Country
- United States
- Adoption stage
- In operation
- Source published
- Date basis
- The date the source was published. It can differ from the date adoption started.
- How the source was checked
- Read the full source text
The work problem
According to a Block customer story published by OpenAI on October 14, 2026, the security team at Block, which runs Square, Cash App and Afterpay, spent days or weeks on work such as reviewing a software bug or parsing a log. Checking a detection change meant requerying hundreds of old cases by hand, so it rarely happened in practice, and triaging false-positive alerts also took many analyst hours.
Technology and data
Block's security team built a security harness on top of OpenAI Daybreak that routes each task to the right model and includes hooks for humans to take over tasks or for agents to verify each other's work. Every investigation stores its raw query evidence so a proposed detection change can be replayed against past production telemetry, and the automated triage system gives every alert a full, deep investigation. For each vulnerability, the team locates where the issue lives in the code and who owns it, proposes a patch and confirms exploitability and the fix, with a human guiding the process and deploying the code changes.
Results
According to the story, replaying a proposed detection change against seven months of production telemetry now takes under an hour, and in recent red team exercises the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes. Chief Information Security Officer James Nettesheim said the automated system performs about 1,100 analyst-hours of investigation per quarter. The story says roughly 600 analyst-hours per quarter that used to go to triaging false positives were handed back and that triage throughput and intelligence gathering and investigations each rose 50%.
Limits and open questions
The story does not disclose the period or baseline for these results or how many patches were applied to production systems.
Sources
- How Block is building AI-powered security with OpenAI technologyopenai.com, Accessed
Compiled from public sources. These are not results from ATF Works customers.