Security: AI Agents
The detection to analysis to risk score to human approval to automated response pipeline, the seven surfaces watched, and why the approval gate is not negotiable.
Markdown. No sign-up, no email.
Security generates more signal than any team can read and demands faster response than any human can give. That tension is why AI belongs here, and why the response stage is exactly where it must be constrained.
The pipeline#
The gate between scoring and response is the whole design. An automated response system without it can be induced to attack its own company: an attacker who learns that suspicious behaviour from an account triggers a lockout now has a denial-of-service tool aimed at whichever account they choose to imitate.
The seven surfaces#
| Surface | What normal looks like, and what does not |
|---|---|
| Logs | Volume, source and pattern. A gap in logging is itself a signal |
| Network | Who talks to whom. New destinations, unusual volumes, odd hours |
| Identity | Login times, locations, devices, privilege use. Behaviour beats credentials as a signal |
| Endpoint | Process behaviour, persistence attempts, unexpected execution |
| Vulnerabilities | What is exposed, how reachable it is, whether it is exploited in the wild |
| Cloud configuration | Public buckets, over-broad roles, open groups. Most cloud incidents are configuration, not intrusion |
| Threat intelligence | What is being used against organisations like ours, right now |
The four agents#
Baseline agent#
Learns what normal looks like per user, service and system, then reports departures. Rules catch known attacks; baselines catch the ones nobody has written a rule for yet, which is the category that matters most.
Reach: telemetry, read-only. Output: deviations with the baseline they departed from.
Analysis agent#
Correlates signals into a story. Ten alerts are usually one event, and the work of turning them into one is the work that used to consume the analyst's night.
Reach: the full signal set, read-only. Output: a correlated incident with a timeline and the evidence for each step.
Scoring agent#
Produces a risk score, and never a decision.
Risk 82/100. Service account authenticated from an unseen ASN at 03:14, then enumerated storage it has never read. No matching change ticket. Credential last rotated 340 days ago.
The score exists to order the queue. The sentence underneath it is what a human acts on, and a score without one is a number that gets acknowledged rather than investigated.
Response agent#
Executes the response after approval, then verifies it took effect and logs everything.
Reach: only the pre-approved response actions, only after a recorded human approval.
What is never automated without approval#
- Disabling an account, including a service account
- Blocking an address range or isolating a host from the network
- Rotating or revoking credentials in production
- Modifying firewall, security-group or access policy
- Anything touching a system already in a declared incident
- Anything irreversible, or reversible only through a vendor
The single argued-about exception is isolating a host during a confirmed active compromise, and it stays behind approval here too. If the response is genuinely too slow to wait for a human, the correct fix is a faster on-call rotation, not an unattended switch that an attacker can learn to pull.
Where this sits against the frameworks#
Checked 9 August 2026. The OWASP Top 10 for Agentic Applications, published December 2025, names tool misuse, goal hijacking and memory or context poisoning as the distinctive risks of agentic systems. Every one of them applies to a security agent with response powers, and applies more sharply because the tools in question are the ones that lock accounts and change access.
That is the argument for the approval gate stated in someone else's words, and it is the reason the gate is not a maturity stage to be outgrown.