For years, the people defending corporate networks have been fighting an unfair war. An attacker only needs to find one way in. Defenders have to guard every door, every line of code, every forgotten server still humming in a closet somewhere. Now both sides have the same new weapon, and the only question that matters is who learns to use it better.

This week IBM and OpenAI placed a large bet on that question. On Monday, IBM announced it had joined OpenAI's Daybreak Cyber Partner Program and launched a new application security service that uses OpenAI's frontier cyber capabilities to examine the software running inside a company, hunting for the weaknesses an attacker would exploit. The reasoning is blunt: attackers are already using AI to probe systems and scale threats faster, so defenders need tools that can respond at machine speed. Investors liked what they heard: IBM's stock rose 3.6% in after-hours trading after the announcement.

What IBM announced

Strip away the press-release language and there are two pieces.

The first is membership in OpenAI's Daybreak program, which gives IBM access to OpenAI's frontier models for security work. The second, and the more concrete, is a new application security service that went live the same day.

Here is what it is built to do. Instead of merely scanning code and flagging anything that looks risky, the service reads through an organization's software and identifies its likely weak points. Then it takes an extra step that older tools skip: it tries to confirm whether each flaw can be exploited. That last part matters more than it sounds.

Anyone who has worked in a security operations center knows the bigger enemy is often noise. Traditional scanners spit out long lists of possible problems, and the overwhelming majority turn out to be harmless. Analysts burn hours chasing false alarms while the one dangerous flaw sits buried in the pile. By sorting the exploitable threats from the theoretical ones, the new service is meant to quiet that noise and aim attention at the handful of issues that could bring a company down.

IBM is also trying to answer the obvious objection to pointing a powerful AI at your source code in the first place. The service runs on IBM Consulting Advantage, the company's AI delivery platform, with what IBM describes as governed, read-only access to a client's code. A company can start with a narrow review of a few critical applications and expand toward continuous monitoring, with the system reassessing risk as the code changes and new threats surface.

The $5 billion effort behind it

The new service is one visible piece of something much larger. IBM recently launched Project Lightwell, a security initiative backed by a $5 billion commitment from IBM and its Red Hat unit. Its target is open-source software: the free, community-built code that underpins a huge share of the modern internet and has become a favorite way for attackers to poison the broader software supply chain.

Lightwell pairs a global team of engineers with AI tools to find and fix flaws in that open-source code, and the OpenAI partnership feeds straight into it, supplying frontier models for code review and repair. The thinking behind the whole program is that securing the world's shared code has grown too big for humans to handle alone, and too sensitive to hand over entirely to machines.

Why this is happening now

The timing is not a coincidence. Attacks have always been partly automated, but AI has changed the tempo. Criminal groups now lean on language models to write convincing phishing lures and probe systems for openings, adapting their tactics faster than human teams can react. Security leaders have a phrase for this, and it is the one IBM and OpenAI keep repeating: machine speed.

"Attackers are already using AI to probe, exploit, and scale threats at machine speed," said Mark Hughes, who leads cybersecurity services at IBM Consulting. Defenders, he argued, need the same advantage, paired with the control that large companies demand.

That anxiety has set off an industry-wide scramble to turn AI from a threat into a shield. OpenAI has its own reasons to be in this fight. "Security is central to realizing the benefits of advanced AI," said Dane Stuckey, the company's chief information security officer, casting partnerships like this one as a precondition for businesses to trust AI at all. OpenAI has separately widened a program called Trusted Access for Cyber and released a security-tuned version of its model, built to cooperate more readily on legitimate defensive work. The other heavyweights are circling the same prize. Google researchers recently used AI to uncover a previously unknown software flaw, and Anthropic has been pushing into AI-assisted defense too. Protecting systems with AI has quietly become one of the most competitive corners of the industry.

So can AI finally defend companies?

Which returns us to the question in the headline.

The honest answer is that it helps, but the word "finally" is carrying a heavy load. The strongest part of IBM's pitch is also the most grounded. Confirming which vulnerabilities are real and cutting through the flood of false alarms are precisely the grinding, repetitive jobs that exhaust security teams, and they happen to be the jobs AI does well. The same goes for keeping watch on code as it changes. If the service performs as promised, a small team could suddenly cover far more ground than before.

The catch is that the same technology works for the other side. The models that surface a flaw for a defender can surface it just as easily for an intruder, which is the entire reason the arms-race framing keeps coming up. AI also still gets things wrong. It misses real problems and occasionally invents ones that were never there, so a human has to stay in the loop. That is exactly why IBM's design leans so hard on governance and read-only access, with engineers working beside the models instead of being replaced by them.

And there is daylight between a launch announcement and a proven record. The service is only days old. Whether it reduces breaches, rather than simply reducing the number of alerts on a dashboard, is something only months of real use will reveal. The industry has been promised AI-powered security before.