SentinelOne says OpenAI Daybreak helped reduce reverse engineering of sophisticated malware from four to six weeks to roughly eight hours.
SentinelOne says it is using OpenAI’s Daybreak cybersecurity capabilities to accelerate malware reverse engineering, with one analysis process that previously took four to six weeks now taking about eight hours. OpenAI published the account on October 14, 2026, citing Gregor Stewart, SentinelOne’s chief AI officer.
The work involves examining software to understand how it behaves. Stewart described Daybreak’s output as comparable to a human researcher’s, while the company says shorter analysis cycles give its security researchers more room to investigate additional malware samples. The article does not specify how many investigations have been completed using the system or provide an independently measured evaluation.
That added capacity could help SentinelOne compare findings across a wider set of samples. The company says links between components in apparently unrelated malware can provide leads for customer investigations and help researchers track relationships among threats. Previously, according to Stewart, the team could deeply reverse-engineer only a small number of programs, limiting opportunities to make those comparisons.
SentinelOne also reports that access to OpenAI’s cybersecurity capabilities has allowed more employees to take on security work, rather than routing every issue through a limited pool of specialists. Stewart said the company wants to bring the capabilities into software development so its engineers can address security issues while building code; the article presents that as an aim, not a completed deployment.
The account also draws a boundary around automation. SentinelOne says people remain responsible for consequential decisions, such as changing software architecture, while some narrower fixes may be candidates for automation. The reported time reduction is a company case study, and the article does not provide broader benchmark results or claim that all malware analysis can be completed on the same schedule.
