Why Agentic AI Can Make Bad Security Decisions Without the Right Context
Summary
The article examines how incomplete or stale context can lead agentic AI to make harmful security decisions, especially in SOC alert triage, and contrasts autonomous action with human-reviewed recommendations that explain their reasoning.
Key points
- An agentic system may make harmful decisions when its context omits relevant facts, such as a device's importance to business continuity.
- The article says excessive context can slow reasoning and cause goal drift or loops, while insufficient context may lead systems to fill gaps with hallucinated information.
- SOC teams receive alerts from many security tools; the article argues that interpreting and contextualizing the data, rather than simply collecting it, is a central challenge.
- Opaque AI recommendations can make it difficult for analysts and managers to understand or audit why an alert was prioritized.
- Lanxit's Security Decision Intelligence Layer is described as gathering current context from security and business systems, explaining its recommendations, and leaving action decisions to users.
- The article cautions that CMDB information may be inaccurate or out of date, so it may not always provide reliable context.
Article Details
- Topic
- Risks of agentic AI in security operations when decisions rely on incomplete or inaccurate context, and the case for explainable, human-reviewed decision support.
People
Adam IrwinManaging partner at Heligan Strategic Advisory; highlighted the lack of visible reasoning and audit trails in decisions shaped by agentic AI.Emanuel SalmonaCEO and co-founder at Nagomi Security; discussed how incomplete or inaccurate context can cause agentic AI systems to make incorrect security decisions.Obbe KnoopFounder and CEO at Lanxit; described a context-based security decision approach that explains recommendations to users and leaves actions to human experts.