Today, Root Managed Services announced that we have joined the OpenAI Daybreak Cyber Partner Program. We’re excited to bring advanced frontier AI capabilities into our security operations to help enterprise clients counter machine-speed threats, and grateful for the opportunity to participate.
Our goal is to connect stronger AI-assisted analysis with the engineering work that improves security: understanding a finding, confirming its relevance, choosing a response, and verifying the result. We plan to bring these capabilities into client engagements through our team’s knowledge of each environment and its operating requirements.
What OpenAI Daybreak brings to enterprise security
Daybreak combines models, security tools, and approved access for defensive work. The partner program enables security providers to apply those capabilities in customer engagements. OpenAI describes a managed-services approach in which approved partners operate the models and clients receive the resulting services. See OpenAI’s Daybreak Cyber Partner Program announcement.
For Root’s clients, our planned approach is a working relationship with engineers who can translate findings into decisions. A useful result should explain the affected asset, the supporting evidence, the business implications, and the next action. We want additional analytical capacity to help our team deliver that level of clarity.
Daybreak versus general-purpose AI: two differences to understand
Daybreak is a program spanning multiple models and access levels. Daybreak Blue uses general-purpose models with safeguards calibrated for defensive cybersecurity. Daybreak Red provides access to specialized cyber models for advanced authorized work and requires separate approval.
Model capability and access settings answer different questions. Capability concerns how well a model reasons through a task. Access settings affect which authorized tasks it can assist with. OpenAI’s Daybreak API guide distinguishes the selected model from the selected access program; an access setting alone does not establish a benchmark advantage.
For a client engagement, we will match the approved capabilities to the task, the sensitivity of the information, and the agreed scope. The comparisons below offer evidence about specific model versions, rather than a universal score for everything carrying the Daybreak name.
Published cyber model benchmarks: GPT‑5.5‑Cyber versus GPT‑5.5
OpenAI’s June 22, 2026 Daybreak release compares these specific models. These historical results do not measure today’s aliases or isolate the effect of access settings.
| Benchmark | GPT‑5.5 | GPT‑5.5‑Cyber | Difference |
|---|---|---|---|
CyberGym | 81.8% | 85.6% | +3.8 points |
ExploitGym | 25.95% | 39.5% | +13.55 points |
SEC-bench Pro | 63.1% | 69.8% | +6.7 points |
CyberGym tests reproducing known vulnerabilities; these are single-model results. ExploitGym tests exploitation leading to unauthorized code execution. SEC-bench Pro assesses extended vulnerability discovery and proof-of-concept generation.
ExploitGym’s 13.55-point gain equals approximately 52.2% relative improvement. This measures benchmark performance, not faster incident response. Different tasks make averaging these scores into a security rating inappropriate.
Our interpretation is that specialized capability is worth evaluating where the task requires sustained investigation and technical validation. In an enterprise setting, however, the practical question also includes whether the finding affects a deployed system, whether a proposed fix preserves required behavior, and whether the team can safely implement it.
Turning AI analysis into useful security operations
We plan to focus on work where better analysis can help our engineers make timely, well-supported decisions. An engagement could begin with a defined application, a set of outstanding findings, or a security workflow that needs more investigative capacity.
- Vulnerability triage: connect an advisory or finding to the client’s actual assets, exposure, and business priorities.
- Investigation support: organize authorized evidence into a timeline, identify unanswered questions, and prepare the next investigative steps.
- Detection review: examine whether a proposed detection addresses the behavior of interest and assess its likely operational noise.
- Remediation planning: compare response options, prepare changes for engineering review, and define tests that can verify the outcome.
Consider a vulnerability affecting a business application. Our intended workflow would establish the installed version and exposure, assess the evidence, identify an owner, and plan a tested remediation. AI assistance can contribute to that analysis while Root’s engineers remain responsible for recommendations and approved actions.
Countering machine-speed threats requires making the path from evidence to action shorter and clearer. We will evaluate where AI contributes to that goal through actual engagement results.
Protecting PHI, PII, and sensitive enterprise information
Root serves enterprise clients whose environments contain protected health information (PHI), personally identifiable information (PII), and confidential corporate data. Those responsibilities will shape how we scope AI-assisted security work.
We will establish the approved systems, permitted actions, and data-handling requirements for each engagement. Our planned process includes minimizing analysis inputs, using sanitized examples where practical, controlling access to findings, and retaining human review for consequential changes. Client information will need to be evaluated against the agreed handling requirements before it is included in a workflow.
We also intend to assess operational quality alongside model performance: time to a validated finding, the proportion of findings confirmed by engineers, time to a verified fix, and changes that require rework. Those measures will help us judge whether a workflow improves the service a client actually receives. This announcement does not report completed Root client benchmark results.
Bringing Daybreak into your security priorities
Joining the OpenAI Daybreak Cyber Partner Program is an opportunity to deepen the technical work behind our enterprise services. We’re looking forward to pairing frontier AI capabilities with the experience, accountability, and environment-specific knowledge our clients expect from Root.
Based in Frisco, Texas, Root Managed Services supports organizations across Dallas–Fort Worth and Austin. Explore our cybersecurity services, monitoring and NOC services, and co-managed IT support, or contact Root to discuss an appropriate starting point for your organization.
Read our Anthropic Cyber Verification Program announcement for more on our investment in internal systems and product security, or return to all Root news and advisories.