Capability Overview
A new architectural category of AI-powered security tooling is crystallising: agentic platforms that go beyond summarisation and Q&A to autonomously execute multi-step workflows across an enterprise’s security stack. Framed around Gartner’s Continuous Threat Exposure Management (CTEM) framework, these systems ingest threat intelligence, correlate it against live asset and exposure data, validate whether existing controls hold, and push prioritised remediation actions — continuously, at machine speed, without waiting for an analyst to prompt them.
This is a meaningful capability shift. For defenders struggling with 40-plus siloed tools and 43-day average breach dwell times, the promise of closing the loop autonomously is compelling. But the same architectural properties that make these agents powerful — persistent integrations, broad data access, autonomous action authority — dramatically expand the attack surface that defenders must now protect.
Attack Surface Analysis
The threat model for agentic security platforms differs qualitatively from assistive AI tools. The key properties that introduce new risk are:
Autonomous ingestion of external data. These agents consume threat intelligence feeds, vulnerability data, and breach simulation results as live inputs. Any of these sources can be weaponised. A nation-state actor who can poison a threat feed consumed by an autonomous agent can cause that agent to suppress, deprioritise, or misframe active intrusion indicators — at machine speed and without analyst review.
Broad, persistent tool-use integrations. Agentic platforms are explicitly designed to bridge SIEMs, BAS tools, ticketing systems, and vulnerability scanners. Each integration is a lateral movement opportunity. Compromising the agent’s API credentials or manipulating its output handling could allow an attacker to pivot into adjacent systems, exfiltrate correlated internal posture data, or inject false remediation tickets that consume analyst time.
Concentrated security context in one system. By design, these agents aggregate what were previously siloed datasets into a single correlated picture. This means the agent’s context window and memory structures contain an unusually complete map of an organisation’s exposure surface. Leakage of this data — through prompt extraction, insecure output handling, or supply chain compromise of the model itself — represents a severe intelligence windfall for adversaries.
Human override erosion over time. As teams build trust in autonomous recommendations and remediation triggers, the practical approval gates weaken. Overreliance risk is structural: an agent that can be deceived operates as a force multiplier for the attacker, not just a degraded defender.
Framework Mapping
- AML.T0051 (LLM Prompt Injection) — External threat intel documents or vulnerability descriptions are attacker-controlled inputs; injection payloads can redirect agent behaviour.
- AML.T0020 / AML.T0010 (Data Poisoning / Supply Chain Compromise) — Upstream data sources are a critical dependency; poisoned feeds propagate directly into autonomous decisions.
- AML.T0057 (LLM Data Leakage) — Aggregated posture data in agent context is a high-value leakage target.
- LLM08 (Excessive Agency) — The defining risk category; autonomous action without sufficient human oversight gates is the core concern.
- LLM07 (Insecure Plugin Design) — Each tool integration is a plugin surface that must be independently hardened.
- LLM09 (Overreliance) — Security outcomes increasingly depend on agent correctness; degradation or manipulation has outsized operational consequences.
Threat Scenarios
Scenario 1 — Feed Poisoning for Alert Suppression. A threat actor operating within an enterprise’s sector begins subtly manipulating a shared threat intelligence feed. The agentic platform, consuming this feed autonomously, consistently deprioritises IOCs associated with the actor’s tooling. The intrusion proceeds undetected within the agent’s prioritisation logic while analysts trust the automated triage.
Scenario 2 — Prompt Injection via Vulnerability Description. An attacker publishes a CVE with a crafted description containing an injection payload. The agentic platform ingests the NVD feed, processes the description in context, and the payload redirects the agent to open a remediation ticket that actually disables a monitoring control rather than patching the vulnerability.
Scenario 3 — Credential Pivot via Tool Integration. The agent’s SIEM integration credentials are extracted through an insecure output handling flaw. The attacker uses these credentials to query the SIEM directly, bypassing the agent entirely and exfiltrating months of correlated security telemetry.
Defender Checklist
- Map every external data source the agent ingests and assess each for injection and poisoning risk prior to production deployment
- Enforce explicit human approval gates for all high-impact autonomous actions (firewall changes, ticket creation, control modifications)
- Apply least-privilege to all tool-use API credentials; scope each integration to the minimum permissions required
- Implement output anomaly detection on agent decision logs — flag unexpected prioritisation shifts or suppression patterns
- Treat the agent’s context window and memory as sensitive data stores; apply equivalent access controls to production security data
- Establish a regular red-team exercise specifically targeting the agent’s ingestion pipeline with adversarial inputs
- Define and test degraded-mode operating procedures for when the agent is unavailable or suspected to be compromised