Check Point says Daybreak cuts vulnerability research from hours to minutes

Check Point says OpenAI’s Daybreak cut its vulnerability-research workflow from hours to minutes, potentially shortening the research behind new security signatures and indicators of compromise. The comparison comes without a disclosed benchmark methodology, task set, sample size, accuracy measure or independent validation.

In the workflow described by OpenAI, Daybreak analyzes vulnerabilities, reasons through possible attack paths and identifies security gaps in code and configurations. Check Point analysts remain responsible for investigating vulnerabilities and translating findings into protections; the account does not describe Daybreak as autonomously publishing signatures or indicators.

Check Point Chief Technology Officer Jonathan Zanger attributed the reduction to automating more of the research process with Daybreak. OpenAI says the models support investigative work behind a signature or indicator of compromise. Its account does not establish that the claimed research speedup produced faster deployed protections, fewer incidents or improved detection accuracy.

Check Point separately said it is using OpenAI’s cyber models to understand vulnerable code and patches, identify realistic exploitation paths and reach verified results faster. That September account described a phased rollout: some related capabilities were in production, while others remained in development or testing with design partners.

The vulnerability-research workflow is separate from Check Point’s planned work with OpenAI on Daybreak-based network-security orchestration. OpenAI says that project would operate within defined boundaries and require human approval for consequential actions, with customers setting security objectives and reviewing findings, recommendations and risks. A separate disclosed deployment shows SentinelOne uses Daybreak for malware analysis while retaining human review for consequential changes.

In its May orchestration announcement, Check Point said security teams would approve high-impact changes before execution and receive a trace of agent actions. Its product page says actions are auditable and reversible, routine operations can run autonomously, and high-impact changes route through human approval. The opened materials do not identify which Daybreak-powered orchestration functions are generally available.