OpenAI unveiled Defense Factory on September 9, 2026, a continuous, agent-first security operation that scans hundreds of systems for vulnerabilities and remediates them, expanding from an internal security sprint run by a team of more than 250 people.

The initiative treats defense as a repeatable, closed-loop process rather than a one-off review, integrating five stages—inventory, discovery, dynamic validation, ownership assignment, and verified remediation—across its operational footprint.

Defense Factory uses AI agents in a continuous loop to identify weaknesses, test fixes, and verify remediation, with architecture designed for human oversight and integration into existing security workflows.

The program is supported by practical resources, including a briefing deck and Daybreak access for authorized cyber defenders, signaling concrete tooling and documentation accompany the process.

The core idea is a continuous cycle that scans for weaknesses, tests fixes, and confirms remediation effectiveness, with OpenAI providing architectures and playbooks to replicate the approach in other security environments.

A clear separation between control and data planes enables isolated, reproducible development environments, supporting secure investigations and reliable testing of fixes.

Defense Factory encompasses five linked stages—inventory, discovery, dynamic validation, ownership assignment, and verified remediation—to ensure a structured, repeatable defense workflow.

Organizations should start with a focused scope around critical AI workflows, documenting scope, testing methods, ownership, and remediation verification to minimize responsibility gaps as AI deployments evolve.

The market for AI-driven vulnerability management is expanding, with opportunities for SaaS platforms and partnerships, facing competition from major cloud providers expanding AI security suites.

Defenses like Defense Factory can reduce breach risk, potentially lower insurance costs, and create revenue paths such as AI vulnerability scanning services and cybersecurity training bundles.

Looking ahead, autonomous AI defense is expected to become widespread by 2028, underscoring responsible AI use, bias mitigation, and human accountability while unlocking new revenue streams in AI security.

Key challenges include protecting data privacy during AI scans and mitigating false positives, addressed through isolated environments, human oversight loops, proprietary-data fine-tuning, and transparent AI decision logging for regulatory compliance.