SentinelOne cuts malware analysis from weeks to hours

Reverse engineering a sophisticated piece of malware can take a top security researcher four to six weeks. It’s painstaking work where researchers pull apart software to understand how it behaves, often retracing their steps as they uncover new information. Gregor Stewart, Chief AI Officer at SentinelOne, says OpenAI Daybreak can now produce human-level reverse-engineering output in roughly eight hours.

By reducing the time needed for deep analysis, OpenAI gives SentinelOne’s researchers room to investigate more malware and connect findings across samples. That wider view often reveals relationships that isolated investigations might miss. Stewart describes the opportunity as “a kind of intelligence that we were never able to afford before.”

“Something that would’ve taken a top-flight researcher four or six weeks to do, AI is now doing at human-level output in something like eight hours.”

—Gregor Stewart, Chief AI Officer, SentinelOne

Investigating more malware in less time

Daybreak gives defenders access to OpenAI models for cybersecurity work. SentinelOne uses these capabilities to reverse engineer malware, examining software to understand how it behaves. Faster analysis gives its researchers more capacity to investigate additional samples.

Stewart emphasizes that his team remains responsible for the outcome. “The only thing that can’t be automated is accountability,” he says. “Take a decision to change the architecture. This is something that still you would want human eyes on, whereas point fixes or things that don’t fundamentally change the way the software works, those might be better suited for automation,” he adds.

Seeing relationships across threats

“Faster reverse engineering enables us to map a much larger part of the malware landscape and keep pace with how it changes. That gives our researchers a clearer picture of how threats are connected and how those relationships evolve.”

—Gregor Stewart, Chief AI Officer, SentinelOne