Detection at Scale Block's CISO James Nettesheim on How 40% of Their Detections Are Now Written with AI
19 snips
Feb 10, 2026 James Nettesheim, CISO & Head of Enterprise Technology at Block, a detection engineering and incident response leader who co-built Goose and helped design the Model Context Protocol. He discusses building Goose and MCP, hardening agents against prompt injection, democratizing detection writing with natural language, Binary Intelligent Triage with 99.9% accuracy, and principled, data-safety driven AI rollouts.
AI Snips
Chapters
Transcript
Episode notes
Goose Began As An Internal Passion Project
- Block's engineers and CTO started Goose as a passion project to unlock agentic AI for the whole company.
- Goose matured alongside the Model Context Protocol and became a reference implementation for general-purpose agent use.
Principled Risk-Taking With Data Safety Levels
- Block treats AI adoption as a principled risk tied to its mission of economic empowerment.
- They implemented 'data safety levels' to map sensitivity to handling and security controls.
Democratize Detection Writing With AI
- Democratize detections by enabling anyone to write detections using natural language and Goose recipes.
- Use AI as step zero and then tune detections and tests with AI to reduce false positives.