OpenAI Daybreak Cuts SentinelOne Malware Analysis from Weeks to Hours
OpenAI announced that SentinelOne is using OpenAI Daybreak, a cybersecurity capability that gives defenders access to OpenAI models, to reverse engineer malware. SentinelOne Chief AI Officer Gregor Stewart says work that would take a top security researcher four to six weeks can now be done at human-level output in about eight hours, allowing researchers to analyze more samples and map relationships across threats.
What OpenAI announced
OpenAI published a customer story describing how SentinelOne uses OpenAI Daybreak for cybersecurity work. Daybreak gives defenders access to OpenAI models for cybersecurity tasks. SentinelOne uses it to reverse engineer malware — examining software to understand how it behaves. The announcement is not a new model release; it is a case study of how an existing OpenAI cyber capability is applied in security operations.
The time reduction: weeks to hours
Reverse engineering sophisticated malware traditionally takes a top security researcher four to six weeks. It is painstaking work where researchers pull apart software to understand behavior, often retracing steps as they uncover new information. Gregor Stewart, Chief AI Officer at SentinelOne, says OpenAI Daybreak can now produce human-level reverse-engineering output in roughly eight hours.
“Something that would’ve taken a top-flight researcher four or six weeks to do, AI is now doing at human-level output in something like eight hours.”
—Gregor Stewart, Chief AI Officer, SentinelOne
Human accountability remains
Stewart emphasizes that his team remains responsible for the outcome. “The only thing that can’t be automated is accountability,” he says. He distinguishes between decisions that change architecture and smaller fixes. “Take a decision to change the architecture. This is something that still you would want human eyes on, whereas point fixes or things that don’t fundamentally change the way the software works, those might be better suited for automation,” he adds.
Seeing relationships across threats
Historically, research teams at SentinelOne had to reserve deep investigation for the most interesting or important threats they uncovered. “We were only able to reverse very small numbers of pieces of software,” Stewart says. With fewer samples to compare, they had fewer opportunities to spot connections between threats.
“Faster reverse engineering enables us to map a much larger part of the malware landscape and keep pace with how it changes. That gives our researchers a clearer picture of how threats are connected and how those relationships evolve.”
—Gregor Stewart, Chief AI Officer, SentinelOne
Faster analysis with Daybreak gives researchers more opportunities to compare malware samples and look for shared components. For example, a component found in two apparently unrelated samples could give researchers a lead to pursue during a customer investigation. Comparing findings across more samples also reveals broader relationships between threats. Seeing those relationships, Stewart says, “would help you defend further out, and be more proactive about your defense.”
Empowering more teams to take on security work
Within SentinelOne, Stewart says access to OpenAI’s cyber capabilities is allowing more people to take responsibility for security work. “Almost everyone now has access to the kind of expertise that was in very short supply until maybe even a few months ago,” he says. More team members can investigate issues themselves rather than relying on a small group of specialists.
Stewart wants to bring OpenAI’s cyber capabilities into code creation, so SentinelOne developers can address security issues as they build.
“OpenAI is shifting the advantage to defenders by providing expert level cyber capability to everyone in the development team.”
—Gregor Stewart, Chief AI Officer, SentinelOne
Implications for defenders
The story frames AI as shifting the advantage to defenders by providing expert-level cyber capability to everyone in the development team. Faster reverse engineering could let security teams cover more malware, connect findings across samples, and act more proactively. The source does not provide specific benchmark numbers, model names, or technical architecture details beyond Daybreak and the time comparison. The only quantified claim is the reduction from four to six weeks to roughly eight hours for human-level reverse-engineering output, attributed to Stewart.