Security operations is a natural early home for autonomous agents. The work is high-volume, well-instrumented, has clear success criteria, and suffers from a labour shortage everyone agrees about. It is also, for the same reasons, where an agent has the most access and the least oversight.
Privilege that cannot be narrowed
A security agent needs broad read access across logs, identity systems, endpoints and network telemetry, because the work is correlation across exactly those sources. Narrowing it defeats the purpose. So the control that would normally bound an agent's blast radius is unavailable in the one deployment where the blast radius is largest.
What remains available is bounding what the agent can do with what it reads: constraining destinations, requiring approval for actions above a threshold, and separating the read path from the act path so that a compromise of one does not confer the other.
Inside the control that would catch it
An agent operating on detection infrastructure sits inside the mechanism that would notice an agent behaving badly. This is not a hypothetical concern; it is the ordinary reason security tooling is held to a higher standard than the systems it protects.
The mitigation is independent observation: a log path the agent cannot write to, and a review process that does not depend on the agent's own reporting. Organisations that deploy security agents without this have taken their most privileged system and made it self-reporting.
Irreversibility under time pressure
The automated response actions that make agents attractive in security — isolating a host, revoking credentials, blocking an address — are precisely the ones that are hard to undo and disruptive when wrong. A false positive that isolates a production system during business hours has a cost measured in the same units as the incident it was preventing.
The reversibility question is worth answering explicitly for each automated action before it is enabled, and the answer should determine whether it runs unattended.
The sampling that disappears
Reducing alert volume is the headline benefit and it carries a subtle cost. The human review being displaced was not only handling individual alerts; it was a sampling process that caught systemic problems — a misconfigured sensor, a detection rule that had stopped firing, a class of event nobody had considered.
Teams that automate triage without replacing that sampling with something deliberate tend to find out later that a whole category of signal has been quietly absent. Retaining a random sample for human review is cheap and preserves the function.