SentinelOne says OpenAI Daybreak cuts malware analysis to hours

News

SentinelOne said OpenAI Daybreak reduced malware analysis from weeks to hours, expanding capacity for threat investigation while keeping human review in place.

SentinelOne said OpenAI Daybreak has reduced some malware analysis work from weeks to hours, a change the company says could let its researchers investigate more threats. The claim appeared in an OpenAI customer case study published on 2026-10-14 and was attributed to SentinelOne Chief AI Officer Gregor Stewart.

Evidence and context

According to the OpenAI case study, Stewart said Daybreak can produce human-level malware reverse-engineering output in roughly eight hours for work that could take a specialist four to six weeks. That is a company statement, not an independently verified general benchmark, and it refers to a specific use case rather than a broad industry average.

The reported benefit is operational capacity: if analysis that once took weeks can be completed in hours, SentinelOne says its teams can review more samples and look for shared components and relationships across threats. Stewart also emphasized that human accountability remains part of the workflow.

The October 14 case study follows SentinelOne’s September 3, 2026 announcement that it was expanding Wayfinder Frontier AI Services with OpenAI Daybreak models, starting with GPT-5.6-Cyber, for code risk analysis, compromise assessments and support for malware analysis. That announcement said the related capabilities were in private preview even though Wayfinder was generally available, so it does not by itself establish broad availability of the newer functions on October 14.

OpenAI described Daybreak on August 10, 2026 as an initiative giving approved defenders access to cybersecurity tools including malware analysis, secure code review and incident response. In market data supplied for 2026-10-14T18:10:15Z, SentinelOne’s token traded at $22.91, down 4.58% on the day, with a market value of $7.82 billion. Those figures describe the token’s market conditions at that timestamp and are separate from the company claims about product performance.

Available material does not show whether the faster malware analysis workflow is broadly deployed across customers or how much of SentinelOne’s security stack it affects beyond the use case described in the case study. No next catalyst date was supplied.