Figma has added a set of AI agents that work directly with its security team to triage alerts, query historic incidents, interrogate internal systems, and even draft code patches. For engineers who build or operate security tooling, the claim of a 70% faster resolution of complex alerts signals a tangible productivity boost and a new pattern for automating repetitive investigative steps.
What changed?
The engineering group created autonomous agents that ingest security alerts, retrieve relevant incident data, call internal APIs, and generate remediation code. The agents improve over time by learning from prior investigations, which reduces the manual effort required for each new alert.
Architectural and operational considerations
Deploying such agents introduces several design questions:
- Data access: Agents need read access to alert streams, incident logs, and system inventories, and write access to code repositories for patch suggestions.
- Model lifecycle: Continuous learning from investigations requires a pipeline for feeding new cases into the model while preserving data privacy.
- Observability: Monitoring agent decisions, success rates, and generated code is essential to detect drift or erroneous outputs.
- Governance: Because agents can act on privileged data, organizations must define approval gates before applying any automatically generated fixes.
Security implications
Automation of investigative steps can reduce human error, but it also expands the attack surface. If an agent’s credentials are compromised, an attacker could query incident data or push malicious code. Practitioners should therefore treat the agents as privileged components, enforce strict audit logging, and consider isolation mechanisms for the execution environment.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Teams should evaluate whether integrating AI‑driven agents into their own alert pipelines could deliver similar speed gains. Start with low‑risk tasks such as log search or alert enrichment, establish clear validation steps for any generated code, and put monitoring in place to track model performance and security posture.
