# Block Raises Security Alert Triage Throughput 50% With Daybreak By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/35125 Published: 2026-10-19T23:54:33.000Z Updated: 2026-10-19T23:54:33.000Z Section: Technology > Block estimates the workflow completes investigation work equivalent to about 1,100 analyst-hours each quarter. Employees remain responsible for validating findings and deploying code changes. Block is using OpenAI’s Daybreak to investigate security alerts, with its security team recording a 50% increase in triage throughput while employees remain responsible for validating findings and deploying code changes. The team also recorded a 50% increase in intelligence gathering and investigations. Block estimates that the workflow completes investigation work equivalent to about 1,100 analyst-hours per quarter and frees roughly 600 analyst-hours per quarter previously spent triaging false positives. Block operates Square, Cash App and Afterpay. Its security harness uses Daybreak to route tasks among models and lets employees take over when needed. The system can trace possible attack paths and propose fixes, while employees assess its findings and guide and deploy code changes. During a recent red-team exercise, the system connected the steps of a simulated attack path in about two hours. In recent red-team exercises, it also produced a patch proposal 18 minutes after receiving a broad description of a vulnerability. That 18-minute interval measures the time to a proposal, not the time to deploy a fix. The team can test a proposed detection change using seven months of production telemetry in under an hour. That replay lets employees examine the proposed change against earlier activity as part of their review. Block Chief Information Security Officer James Nettesheim described the process as one that checks the vulnerability and the proposed remedy “with a human in the loop guiding it and deploying the code changes.” Employees retain responsibility for putting those changes into use. A separate [SentinelOne use of Daybreak]() involved a malware reverse-engineering task completed in roughly eight hours, compared with four to six weeks for a specialist. Block’s figures concern alert triage, investigations and patch proposals rather than that malware analysis task. Block is evaluating its security systems against internal benchmarks and their performance in use as it considers applying them to more sensitive systems. ## Links in this article - [SentinelOne use of Daybreak](https://www.tokenpost.com/news/technology/32003)