AI in Action: Transforming Cyber Defense Strategies with Agentic MDR

While various AI and machine learning automated workflows offer a great deal of insights into complex prediction and computation problems, recent advances in generative AI provide excellent summarization and content generation capabilities for a broad range of use cases. This means that search results are more comprehensive and accurate, often tailored to end-user needs. However, one remaining opportunity is to get the end-to-end job done with accuracy, speed and more importantly, agility. This entails transitioning from merely completing tasks to achieving outcomes with human supervision and control as appropriate.

Agentic AI is the answer to this transition. The newer AI can take actions on its own instead of merely giving information or content for a human to react to.

Scenarios where high-value high-confidence detection could be responded to with a high-accuracy remediation or response are where Agentic AI excels. While users may want to configure the so called “automated and self-driven” action, there should be complete transparency, accountability, and explainability around what happened, what conclusions were made, what data points were used to validate the accuracy and confidence, and finally, what actions were taken with what outcomes or impact.

This is where Agentic MDR offers an end-to-end managed detection, investigation, and response framework that's dynamically configured based on the situation, user input, and thresholds to get the security analyst’s work done.  

The Need for Agentic MDR

Modern-day threat actors do not need to be skilled to do their jobs. While skilled threat actors have traditionally been more successful, technological advancements, the availability of effective tools, and lower costs make it easier for unskilled threat actors to leverage technology, and craft newer, effective ways to compromise users, infiltrate infrastructure, move laterally, and exfiltrate valuable data in a matter of hours instead of days.

Managed Detection and Response (MDR) service providers have built their services based on security tooling and human experts who work in tandem to monitor indicators of compromise, investigate potential threats, and sift through the volumes of signals to focus on high-value detections and quickly respond to high-confidence threats.

1. Manual Configurations: There are technological gaps rooted in certain choices and configurations made by security teams. Sometimes, disparate tools from different vendors make it difficult for MDR and SOC teams to manage alert volumes. While data volumes are almost impossible for humans to parse for indicators of compromise, investments in SIEM and XDR platforms give them a fighting chance. 
2. Inconsistencies: Apart from configurations managed by humans, subsequent human-expert-driven triaging and investigations introduces the element of inconsistency and error that can prove costly.
3. Repetition: Repetitive and mundane tasks that vary slightly can be easily offloaded to LLMs that learn from historical data and user feedback mechanisms. 

In the world with the promise of self-driving automotives and potential self-driving capabilities that often offer excellent assistance to the drivers, agentic AI offers similar, accurate, consistent, and impactful capabilities to dynamically react to alerts, make decisions around what sources to probe for additional fact finding, and assists MDR teams with insights that might be missed due to user errors, misconfigurations, and inadequate data points needed to build a high-confidence dispositioning.

• Skilled: These agentic AI components are skilled at performing functions like automatic identification of additional sources to probe, human expert behavior-based learning for case summarization, and remediation or response guidance.

• 24x7 availability: Agentic AI components serve as 24x7 watchdogs, monitoring signals and engaging with customers for custom queries, reporting, and investigation needs. They provide timely escalation and assistance for security incidents, especially when human experts may have their guard down or when response latency increases. 

Making Agentic MDR Work for You

These agentic AI components offer certain skills that can be weaved together to create a new fabric, redefining the permutations and combinations of layered security models. They have an ability to configure, deploy, detect, investigate, reconfigure, and act decisively to detect and respond to complex and advanced persistent threats seeking weaknesses and gaps to exploit.

Agentic AI models are built with transparency, accountability, user control, and explainability in mind.

• User Control: Provides human experts with the ability to define the appropriate level of automation for their operating and business environments. Users can decide when to relinquish control to automation and when to override it in case of any errors to avoid impacting business and service continuity.
• Transparency: Any actions taken by the system using artificial intelligence should provide reasoning and references to the data points that were used for those actions and conclusions and clear identification of when AI is in use.
• Explainability: Provides enough information and process of generating the context and its confidence on the AI produced context.
• Accountability: Ensures AI and AI-powered features are accountable, making the natural interlacing of human and machine actions easily distinguishable for reporting or auditing.

Apart from threat prioritization and investigation capabilities, agentic AI offers dynamic capabilities for threat hunting and attack prediction. It allows:

• Rapid selection, execution, and tuning of threat hunting queries based on the evolving threat landscape.
• Quick analysis of emerging threats and new attack vectors for their signature and behavior patterns, with sweeps based on customers’ domains, geographies, and risk profiles.
• Identification and eradication of threats from customer environments.

Summary 

Agentic AI represents the next maturity level for automated and smarter systems that use various forms of machine learning, mathematical, and statistical models for prediction and confidence building, and generative AI for language translations, knowledge articulation, and summarization and to get the job done. It is a goal-oriented, dynamic, skill-based system that continuously learns and adjusts based on threat and end-user behaviors, offering the highest level of transparency and control. These responsible AI aspects define the maturity levels of services offered by Agentic AI.