Block Saves 600 Hours per Quarter with OpenAI's AI

Block claims to have drastically reduced its response times and increased several capabilities of its security center by leveraging workflows powered by OpenAI Daybreak. The company reports recovering 600 hours per quarter and implementing human mechanisms to oversee automation, from triage to investigations.

600 Hours Recovered and 50% Increase in Capabilities

Block states that its detection and response processes have resulted in the recovery of approximately 600 analyst hours per quarter, which were previously spent on sorting false positives. The company reports a 50% increase in triage capacity as well as a 50% rise in information gathering and conducting investigations, and also mentions the emergence of an autonomous hunting feature. According to James Nettesheim, each alert undergoes a thorough investigation, treated as if it were unique on that day. Additionally, around 1,100 hours per quarter are still dedicated to investigations.

Compressed Timelines: From 18 Minutes to Less Than an Hour for Replay

Block measures 18 minutes between the submission of a high-level vulnerability and an automated fix proposal. The team can also replay a detection change in less than an hour, compared to seven months of telemetry. Tasks such as reviewing software bugs or analyzing logs, which previously took days or weeks, are now completed in a fraction of the time, with human validation of each result.

Daybreak Orchestration, Dedicated Models, and Human Oversight

Each investigation retains evidence of raw queries, which helps accelerate the tuning of detections. Previously, to replay a modification, it was necessary to manually review several hundred cases, which was rarely done due to the time required. The team has optimized the selection of models for each use case and implemented a security system based on Daybreak to assign each process to the appropriate model. This system includes control mechanisms, allowing analysts to take over or enabling agents to oversee the work of their peers.

Reconstructed Attack Chains and Declared Governance

Block distinguishes isolated alerts from traditional scanners from its analyses, where the model formulates hypotheses and links events into a complete compromise path, which can reveal vulnerabilities that have existed for years. One cited example involves an alert on a laptop, initially perceived as a simple policy issue, which uncovered a broader set of problems after the model tracked an incident indicator in the evidence. The company claims to adopt AI responsibly, under the guidance of James Nettesheim, who describes AI as a teammate. Nettesheim sees the potential to reduce the number of vulnerabilities introduced upstream and believes that OpenAI makes these capabilities accessible to critical infrastructures, schools, and small businesses. Block, a major North American company in the finance and technology sectors, also mentions Codex. With the time saved, the team is focusing on more in-depth investigations and building responsible automation. The initial goal was to reduce the time to remediate vulnerabilities, as approximately 600 hours per quarter were consumed by sorting false positives.