IT Operations Automation · Security and Compliance
Block needed to shrink the time required to tune detections, investigate alerts, and move from a high-level vulnerability description to a validated patch, while reducing the analyst effort consumed by false positives and repetitive security investigations.
Reported impact
Block now replays detection changes against months of telemetry in under an hour, generates automated patch proposals in 18 minutes during red-team exercises, returns roughly 600 analyst-hours per quarter from false-positive triage, and completes about 1,100 analyst-hours of investigations each quarter with AI assistance.
Block built an AI-assisted security operations workflow around OpenAI Daybreak, Codex, and its own security harness so vulnerability discovery, detection tuning, investigation, and remediation could run much faster without removing human oversight. Every investigation stores raw query evidence, which lets the team replay a proposed detection change against seven months of production telemetry in under an hour instead of manually requerying hundreds of older cases. Daybreak also helps connect signals across endpoint and identity logs, surfacing broader attack paths that would remain invisible inside any single tool. During red-team exercises, the system chained together SQL injection, privilege escalation, foothold establishment, credential enumeration, and pivots to other systems in about two hours. Codex then helps turn high-level vulnerabilities into proposed patches that humans review, validate, and deploy.
Investigation evidence, seven months of telemetry, vulnerability descriptions, endpoint alerts, and identity logs flow into Block's Daybreak-based security harness. The harness routes work to the right models, Daybreak analyzes cross-system signals and proposed detection changes, Codex drafts patches, and human reviewers confirm exploitability and approve deployment.
"For example, for detection tuning, every investigation stores its raw query evidence, so the team can now replay a proposed detection change against seven months of production telemetry in under an hour."
"In recent red team exercises, the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes."
"The automated triage system has resulted in faster work (and more of it) getting done. Block’s security team has seen a 50% boost to triage throughput, a 50% increase in intelligence gathering and investigations, and an entirely new autonomous hunting capability."
"This performs ~1,100 analyst-hours of investigation per quarter, because every alert now gets a full, deep investigation across all elements the alert involves."
"You propose a patch, you confirm exploitability, and then you verify that you have fixed it, with a human in the loop guiding it and deploying the code changes."
Review how this reference was scored and trace each normalized claim back to its documented source.
Scoring methodology
Customer Reference Value measures usefulness as a customer reference. Evidence Confidence measures the quality and traceability of available evidence, not independent verification.
Traceability
Field coverage shows which facts each source supports. Dates are shown only when documented by the source.
Related
OpenAI Sample Dec 12, 2025 BNY BNY wanted to scale generative AI across a systemically important financial institution without treating it as a side experiment, so it needed a governed way for employees to build agents, use frontier models, and… 20,000 employees actively building AI agents ChatGPT Enterprise · Eliza · deep research OpenAI Sample Oct 9, 2026 Sophos Sophos needed to investigate and respond to a growing volume of cyber threats faster, while scaling its expertise across every protected customer without matching growth in scarce analyst headcount. 52% of MDR cases resolved end-to-end by AI OpenAI Daybreak · OpenAI models · Sophos Fusion OpenAI Sample Oct 8, 2026 Datadog Datadog (opens in a new window) runs one of the world’s most widely-used observability platforms, helping companies monitor, troubleshoot, and secure complex distributed systems. When something breaks, customers depend… Codex 