Block, the company behind Square, Cash App, and Afterpay, has brought OpenAI’s technology into the core of its security operations.
The details come from a case study published on October 14, 2026. It describes a custom security orchestration system called Daybreak, which Block developed in partnership with OpenAI.
What Daybreak actually does
According to the case study, Daybreak automates three of the most labor-intensive jobs in a security team: vulnerability discovery, threat detection, and incident response.
It works by linking security signals that would otherwise sit in separate silos. It also simulates attack paths, which means it maps how an intruder could move from one weakness to the next.
The workflow has a clear boundary. The AI handles signal correlation and drafts issues for the team. Humans verify the findings and deploy any changes.
The numbers behind the pitch
Block reports efficiency gains that would get any security leader’s attention.
Triage throughput rose by roughly 50%. The volume of intelligence gathering and investigations climbed by about the same margin.
The system now automates around 1,100 analyst-hours of investigative work per quarter.
Block also says it recovered approximately 600 analyst-hours that had been spent triaging false positives.
In red-team exercises, Daybreak completed full attack-path chaining in approximately 2 hours. It produced a proposed patch in 18 minutes.
It also replayed telemetry covering 7 months of data in less than 1 hour.
Why the human-in-the-loop design matters
The 18-minute patch figure deserves to be read in context. It is a proposed patch, not a deployed one. The remediation clock still includes the time it takes a person to confirm the fix is correct and safe.
Nothing goes into production on the model’s say-so. For a company that moves money for merchants and consumers, that guardrail is the whole point.
What this means for fintech and security spending
The research accompanying the case study suggests firms that adopt similar AI tools may see notable cost savings and stronger security outcomes, and investors could come to view those firms as more resilient against cyber threats.
The efficiency numbers are Block’s own reported figures from its own environment. Other companies with different tooling, data quality, and team structures may not see the same results.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.