Block's security agents keep the raw evidence behind every investigation. That turned a rare task into an hour

An alert on one laptop looked like a minor policy issue. During peer review, the model working the case followed an indicator that appeared only incidentally in the evidence, joined it against Block’s identity logs and found a much larger set of problems. “One routine endpoint alert became a campaign takedown,” says James Nettesheim, Block’s CISO. “No single tool makes that join. The signal only exists across two products’ logs.”

That story, from an OpenAI customer profile published on October 14, is the kind usually told about AI in security operations: the agent sees what a busy analyst would miss. The more useful lesson in Block’s account is quieter, and it is about what the system keeps.

The practice: store the evidence, not just the verdict

Block, the company behind Square, Cash App and Afterpay, runs detection, investigation and vulnerability work through a security harness built on OpenAI’s Daybreak. According to the profile, every investigation stores its raw query evidence. Because of that, the team can replay a proposed detection change against seven months of production telemetry in under an hour.

Before, testing a detection change meant requerying hundreds of old cases by hand, and Block says it rarely happened in practice. Detection tuning without a regression test is guesswork: a rule tightened to cut false positives can silently stop catching the thing it was written for. Stored evidence turns past investigations into a test set. Each new rule can be checked against what actually happened, before it goes live.

This is the transferable idea, and it does not depend on Daybreak. Any AI investigation that records only its conclusion produces an opinion. One that records the queries it ran and the data they returned produces something a reviewer can check, a regulator can sample and a future change can be tested against. It is the difference between an agent’s summary and evidence kept outside the agent.

The results, as Block reports them

The figures are customer-reported and come from Block’s environment:

• under an hour to replay a detection change against seven months of telemetry;
• about 600 analyst-hours per quarter handed back from false-positive triage;
• about 1,100 analyst-hours of investigation completed per quarter, because every alert now gets a full investigation;
• a 50% increase in triage throughput and in intelligence gathering and investigations;
• in recent red team exercises, 18 minutes from submitting a high-level vulnerability to an automated proposed patch.

That last number deserves care. A proposed patch is not a deployed fix. Block describes its process on every finding as locating the issue and its owner, proposing a patch, confirming exploitability and verifying the fix, “with a human in the loop guiding it and deploying the code changes.”

The architecture around the model

Three design choices in Block’s harness are worth copying:

Routing by task. “We used to use the latest model, but you don’t need to do that anymore,” Nettesheim says. The harness routes work to different models for different tasks, which is how cost and depth get balanced in a system that investigates every alert.

Handover points. The harness includes hooks for humans to take over a task and for agents to verify each other’s work. Peer review between agents is where the laptop case turned into a campaign.

Continuous evaluation. The team evaluates the system against internal benchmarks and real-world performance and routes work to human review “when that is the responsible path.”

Autonomy on a ladder

Block is explicit that agents do not carry the organization’s context or the reasoning behind previous decisions; people supply that. “As AI’s judgment is proven out in practice,” Nettesheim says, “we’ll slowly ladder up the risk level to use it for more sensitive systems.” That is the approach we argued for in autonomy earned per action class, stated by a CISO of a regulated financial company.

Sophos showed a related pattern last week, with agent authority set by each customer’s response mode. Block’s contribution is the evidence layer underneath. If you are building or buying an AI security assistant, ask one question first: when it closes a case, can you replay what it saw? If the answer is no, the speed you gain today becomes an audit problem later.