Skip to content
kevinferron.com

T4 · Security in the age of AI · Interactive, in your browser

What watching all the time looks like

A loop of sensing, detecting, triaging and responding, with agents on the first pass and people making the call.

The first pass can be automated; the decision stays with a person.

An estate, and the loop that watches it

Illustration

Sensors feed a loop of four stages. Tap a stage to see the framework outcomes it is tied to and who does it in the mode you have chosen.

  • Laptop AEndpoint telemetryDE.CM-09
  • Laptop BEndpoint telemetryDE.CM-09
  • Laptop CEndpoint telemetryDE.CM-09
  • Cloud tenantCloud audit logDE.CM-09
  • Edge deviceNetwork logDE.CM-01
  • AccountsSign-in logDE.CM-03

Sense

Collect what the estate is doing: network traffic, who is doing what on which account, and what is running on each machine.

NIST CSF 2.0, Detect function

  • DE.CM-01Networks and network services are monitored.
  • DE.CM-03Personnel activity and technology usage are monitored.
  • DE.CM-09Computing hardware and software, runtime environments and their data are monitored.

NIST CSF 2.0: Appendix A, DE.CM Continuous Monitoring: DE.CM-01, DE.CM-03 and DE.CM-09

People only, business hours: Sensors.

The four stages are my simplification. The subcategories are CSF 2.0’s, and the framework does not prescribe how an outcome is achieved. Which sensor feeds which subcategory, below, is an illustration.

Who watches, and when

Illustration

The same invented intrusion, started out of hours. A person is at work in the band from chapter one: 08:00 to 18:00, Monday to Friday.

Sensors keep logs all week, but a person reads them, and only in the band.

Illustration
  1. An unusual sign-in—
  2. The session is used on the cloud tenant—
  3. A laptop runs a tool it has not run before—
  4. The events are correlated and an incident is declared—
  5. Validated, prioritised and scoped—
  6. Contain, then eradicate—

Playback has not started.

Press Play to run the intrusion, or switch mode and run it again.

The first three events happen the same way in every mode, and so does the intruder. What changes is who picks the incident up, and when. The hours a person is at work are chapter 1’s band. If nobody is reachable out of hours, the decision waits for the band like everything else.

Why a person decides at respond: OWASP’s guidance on excessive agency says to require human approval for high-impact actions. NIST’s SP 800-137 adds only that monitoring cannot be done efficiently by manual processes alone or by automation alone, which is about efficiency, not about who responds. Where exactly the person sits is my illustration; neither source says which step.

The estate, the intrusion and every time in the playback are invented to show the shape of the loop. No source gives times like these. Only the framework mappings and the guidance are sourced.

The agents are a system to watch too

The agents’ own risks are hidden.

Switch it on to see where prompt injection and excessive agency apply in the loop, and what the guidance says to do about them.

NIST’s SP 800-137 defines information security continuous monitoring as maintaining ongoing awareness of security, vulnerabilities and threats to support risk decisions. It says monitoring cannot be done efficiently by manual processes alone or by automation alone, and that automated tools make it more cost-effective, consistent and efficient. “Continuous” there means often enough for the decisions, not literally around the clock.

CSF 2.0 breaks the work into outcomes. Its Detect function covers continuous monitoring of assets and the analysis of adverse events, and its Respond function covers incident management, analysis, mitigation, reporting and communication. The figure ties each stage of a loop to the subcategories involved, from monitoring networks, activity and systems, through correlating events and declaring an incident, to triage, root cause, containment and eradication. The framework does not prescribe how an outcome is achieved. CISA’s performance goal 4.B adds one instruction: automate event analysis as much as possible, to speed investigation and free analyst capacity.

The evidence that automation helps is thinner and comes from a sponsor. IBM’s 2025 breach study (research by the Ponemon Institute, sponsored and analysed by IBM, which sells security AI) found that organisations using security AI and automation extensively had breach lifecycles 80 days shorter and costs USD 1.9 million lower than those using none. That is an association reported by a sponsor, not a controlled comparison.

Anthropic, which sells the model, recommends that security teams experiment with AI for security operations centre automation, threat detection, vulnerability assessment and incident response, and says its own threat intelligence team used the model extensively to analyse the data from the investigation. That is a recommendation and a report of its own use, not a measurement of how well agents do the first pass. I found no source that gives a share of incidents detected by AI agents.

An agent that watches your systems is itself a system to watch. OWASP’s 2025 list for LLM applications puts prompt injection first: content the model reads, including content from files and websites it ingests, can change what it does in ways nobody intended, and OWASP says it is unclear whether fool-proof prevention exists. Excessive agency, its sixth item, is a damaging action taken on unexpected or manipulated model output because the agent had too much functionality, permission or autonomy. OWASP’s mitigations include least-privilege identities, human approval for high-impact actions and logging what the agent does. The joint guidance on deploying AI securely, from the NSA, CISA, the FBI and partners, says to log a model’s inputs, outputs, intermediate states and errors, and to automate alerts.

My viewMy view: this is the shape of what I mean by an agent swarm. Agents do the first pass at any hour: sensing, detecting and triage. A person decides what to contain, because I think monitoring needs both people and automation (SP 800-137 says it cannot be done efficiently by either alone), and because an agent that can end a session on its own is the agent with excessive agency. The figure shows the catch. With people plus agents, the decision still waits if nobody can be reached out of hours, so the staffing question does not go away; it moves to who can be asked. Every time in the playback is invented, and I am not claiming that any real setup is that fast.

Exercise

Try the loop.

  1. Play the intrusion with people only, and note which step waits for a person.
  2. Switch to people plus agents and find the step where the agent hands a decision to a person.
  3. Switch on the agents’ own risks and decide which of your tools read text that an intruder could have written.

Sources

  1. NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. Sep 2011; read 2026-10-24.

    Executive summary, chapter 1 and its footnotes.

    • Executive summary, chapter 1 and footnote 2: the definition, manual against automated, and what continuous means
    • PDF page 7: monitoring cannot be done efficiently by manual processes alone or by automation alone

  2. NIST CSF 2.0 The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). 26 Feb 2024; read 2026-10-24.

    The functions (section 2) and the Detect and Respond subcategories in Appendix A. The framework does not prescribe how outcomes are achieved.

    • Section 2 and Appendix A: the Detect and Respond functions and their subcategories; the abstract on not prescribing how
    • Appendix A, DE.CM Continuous Monitoring: DE.CM-01, DE.CM-03 and DE.CM-09
    • Appendix A, DE.AE Adverse Event Analysis: DE.AE-02, DE.AE-03, DE.AE-07 and DE.AE-08
    • Appendix A, RS.MA and RS.AN: RS.MA-02, RS.MA-03 and RS.AN-03
    • Appendix A, RS.MI Incident Mitigation: RS.MI-01 and RS.MI-02

  3. CISA, CPG 2.0 Cybersecurity Performance Goals 2.0 (goal listing). as fetched 2026-10-24.

    CISA’s HTML listing of the goals; the CPG 2.0 report PDF was not downloaded.

    • Goal 4.B: automate event analysis as much as possible
    • Goal 4.B: automate event analysis as much as possible to speed investigation and free analyst capacity

  4. IBM, Cost of a Data Breach 2025 IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications. 30 Jul 2025; 600 organisations, breaches Mar 2024 to Feb 2025; read 2026-10-24.

    IBM’s newsroom release, not the gated report. Research by the Ponemon Institute, sponsored and analysed by IBM, which sells security AI. Associations, not controlled comparisons.

    • The 2025 release: breach lifecycle and cost with extensive security AI and automation against none

  5. Anthropic, November 2025 Disrupting the first reported AI-orchestrated cyber espionage campaign (full report). Nov 2025; read 2026-10-24.

    Read in full. Anthropic reports on misuse of its own model and sees only that model’s use.

    • Page 14: teams should experiment with AI for SOC automation, detection, vulnerability assessment and incident response; its own team used Claude extensively

  6. OWASP, LLM01:2025 LLM01:2025 Prompt Injection. OWASP Top 10 for LLM Applications 2025; read 2026-10-24.

    • Description: direct and indirect injection; unclear whether fool-proof prevention exists
    • Description (direct and indirect injection; unclear whether fool-proof prevention exists) and the prevention and mitigation list

  7. OWASP, LLM06:2025 LLM06:2025 Excessive Agency. OWASP Top 10 for LLM Applications 2025; read 2026-10-24.

    • Root causes and mitigations: least privilege, human approval for high-impact actions, log and monitor
    • Mitigations: require human approval for high-impact actions
    • Description and root causes (excessive functionality, permissions, autonomy) and the mitigations

  8. Joint guidance, Deploying AI Systems Securely Deploying AI Systems Securely (joint cybersecurity information sheet). Apr 2024, version 1.0; read 2026-10-24.

    Read from the copy on the FBI’s ic3.gov; the NSA-hosted copy refused the fetch. Written for organisations deploying AI built by others. By the NSA, CISA, the FBI and partner agencies of Australia, Canada, New Zealand and the UK.

    • Pages 7 and 8: log inputs, outputs, intermediate states and errors; automate alerts
    • Pages 7 and 8: monitor model behaviour, log inputs, outputs, intermediate states and errors, alert on anomalies, and control administrator access

Everything here is paraphrased from the sources, not quoted at length, and each claim is attributed to one. A prediction is kept as its source’s prediction, with its hedge. Vendor figures and a vendor-sponsored study are labelled as such. Where a source is silent or could not be read, the page leaves the fact out.