Security Leader Brief

Guard Your Defensive AI Agents Before You Expand Their Autonomy

Peter Campbell

A defensive AI agent sits inside a fixed boundary. Attacker-controlled input (log fields, filenames, alert text) flows into the agent. The boundary has four guardrails: no open internet, scoped tools, an audit log the agent can’t edit, and human approval before disruptive actions. Caption: defensive agents read attacker input, so constrain them like any production workload.

Tap or click the diagram to open it full size.

Why it matters to you: Niels Provos, Phil Venables, and Microsoft agree that a faster alert-driven SOC still loses to AI-driven attackers, and they prescribe three different fixes: invariants that remove attack paths, self-regulating control loops, and an agentic SOC. Read together, they are layers of one design, not rival strategies. But the two adaptive layers hand security decisions to a model that reads text the attacker controls. Without fixed limits on that model, you add attack surface at the point meant to reduce risk.

What we found reading them together

  • Invariants come first. Controls like no general internet egress from production don’t weaken as attackers try more often, and they shrink what the adaptive layers have to handle. Provos estimates three invariants would have prevented 65% of about 70 public breaches he reviewed; that is his analysis, and we have not checked it.
  • None of the three constrains the defensive agents. Microsoft’s operating model leaves agent authorization, tool boundaries, and audit undefined. Venables’s guardrails are themselves adaptive, and a model manipulated by injected input can’t be trusted to notice its own drift.
  • The fix is the invariant method pointed inward. Treat each defensive agent as an untrusted production workload: no general egress, scoped tools, an audit journal it can’t write to, and human approval before disruptive changes such as cutting network routes or isolating an identity provider. Read-only and low-impact work can stay at machine speed.

Ask your team

  1. Which actions can our SOC agents take without a human, and which disruptive ones require approval?
  2. Can any of our defensive agents reach the open internet or alter its own audit trail?
  3. When did we last run known-malicious activity through the AI pipeline and count how often it was closed as benign? (This test comes from Anton Chuvakin.)
  4. What do our agentic-SOC vendors say stops a response agent from acting on injected alert content?

What we don’t know yet

This is our synthesis of three essays and a vendor whitepaper, not a measured test. The layering argument is ours, not any author’s. We haven’t seen published measurements of how well these guardrails hold against injected alert content. Until someone publishes them, assume an agent’s verdicts can be steered. Fixed guardrails limit what a steered agent can do; they don’t stop it from closing a real intrusion as benign, which is why the third question matters. Security Sonar plans to measure both in its lab.

The sources, for your technical team: Niels Provos, “Security at Machine Speed Is the Wrong Race”; Phil Venables, “Autonomic Defense: Countering AI-Driven Offense at Machine Speed”; Microsoft, Agentic SOC: The New Operating Model for Continuous Defense.

Security Sonar is focused on security standards and guardrails for agentic AI. If your team is deciding how far to trust agents inside the SOC, start with the second question above: what fixed limits apply to the defensive agents themselves? See securitysonar.com.