2Gen has been approved for Daybreak Blue, OpenAI’s controlled-access programme for cyber defenders. Here’s what it means, how we use it and what our customers can expect.

AI has made it much faster to find weaknesses in software. That cuts both ways. The tools that help developers find bugs can also help attackers identify vulnerabilities.

Defenders need access to capable tools too. That’s the idea behind OpenAI’s Daybreak programme. 2Gen has been approved for its Daybreak Blue tier.

What is OpenAI Daybreak?

Daybreak is OpenAI’s programme for security teams carrying out authorised cybersecurity work. In August 2026, OpenAI expanded it into two access tiers.

Some advanced security requests are restricted by standard AI models because the same techniques could be used for attacks.

Daybreak reduces some of these restrictions for approved security professionals, allowing them to carry out legitimate defensive work more effectively. OpenAI’s usage policies and other safeguards still apply.

What is the difference between Daybreak Blue and Daybreak Red?

Daybreak Blue gives approved teams access to supported general-purpose AI models with safeguards adjusted for defensive security work.

This includes reviewing source code, identifying vulnerabilities, analysing malware, investigating security incidents and checking whether security fixes work.

Daybreak Red is designed for specialist security research teams. It provides separately approved access to advanced cybersecurity models for vulnerability research, exploit validation and penetration testing.

2Gen has Daybreak Blue access.

This doesn’t remove every restriction. It also doesn’t replace the judgement of experienced engineers.

How do we use it?

We use Daybreak Blue primarily in our AI App Security and AI App Assurance work.

More businesses are building software with AI coding tools. Development is faster, but the resulting applications can be more complex than the teams building them realise.

Daybreak Blue helps our engineers:

• Review larger amounts of source code for potential security weaknesses.
• Prioritise findings so attention goes to the issues that matter most.
• Check whether security fixes have addressed the original problem.
• Analyse logs and other evidence during security investigations.

The goal isn’t to replace manual testing. It’s to help our engineers work more efficiently and spend more time investigating potential risks.

Who is in charge of the testing?

Our engineers.

AI helps identify potential issues, but a person reviews the findings, verifies them and decides what belongs in the final report.

We only test systems we’re authorised to assess. Before starting, we agree on the scope of the review and whether AI tools can be used to analyse your code.

Daybreak Blue is used internally by 2Gen for authorised security work. It doesn’t provide customers with direct access to OpenAI’s programme.

Where Daybreak Blue fits in our security work

Daybreak Blue is one tool in a wider body of security work. Here is what else we have been doing recently.

A pre-launch review for a NSW Government department

We completed a security assessment of a new public-facing website for a NSW Government department. It covered the public site, the user portal and the admin system. We combined hands-on testing with a source code review. Every fix was retested before we signed off with a security attestation ahead of go-live.

Security reviews of customers’ AI projects

More of our customers are building with AI. Much of that code is now written by AI too. We review these projects before they go live: who can see what, how customer data is handled, how the AI tools are connected and whether the cloud setup is locked down.

In development: AI-powered security monitoring

We are developing an AI-powered SIEM (a security monitoring system) to detect, alert on and help manage AI-related security issues across a business. More to share soon.

What does this mean for you?

If we’re reviewing your software, you’re still working with the same engineers, but they have access to more capable security tools.

This can help us examine more code, identify potential weaknesses sooner and focus our attention on the risks that matter.

You receive clear findings, practical recommendations and verification of fixes as agreed in the review scope.

It’s particularly useful for businesses developing applications with AI, where large amounts of code can be produced quickly without the same level of security review.

If you’re building software with AI, or have an application going live soon and want an independent security check, we’d be happy to talk.

This article was first published on 2genai.com.au, the home of 2Gen’s AI practice.

Source: OpenAI, Expanding Daybreak as the Cyber Defense Window Narrows, 10 August 2026.