Hand Security Operations to Resident AI Agents: Decide Permissions, Monitoring, Records and How to Stop First

Vulnerability reports keep increasing, and attackers now move automatically the moment a fix is released. In this article I lay out, as my own decision criteria, who should run a company's security operations. On October 20 I talked about how a company's speed is set by the round-trips of human decisions, on October 21 about taking risks with reversible operations and parallel running, and on October 22 about rebuilding the organization and systems around resident AI agents. This time I apply that to defense.

To be clear from the start, this is not about blaming the people on the front line. It is not that they are lazy; the speed and volume of attacks have simply outgrown what people can watch in shifts. Choosing how the company defends itself is the president's job.

The conclusion is a choice between two

Security operations can no longer keep up if they assume people run them by hand. If you defend in-house, build an operation where resident AI agents handle most of the work. If you cannot, ride on a giant platform. I see it as this two-way choice, made not once for the whole company but system by system. For example, email and spreadsheets can ride on a giant platform, while systems deeply tied to your own business stay in-house and are guarded by resident agents. The most dangerous option is to keep your own systems while still defending them by hand.

Riding on a giant platform does not hand over all of your defense. Which permissions go to whom and which accounts stay in use are still decided by the user. If someone has not set up two-factor authentication, the door stays open no matter how large the platform. Having resident agents check this constantly makes it much easier.

What is happening now

According to topics shared on X, the monthly number of reports in the US vulnerability database NVD grew from 4,389 to 15,074 in one year, roughly 3.4 times. The figures are only what was shared, but I take it to mean that the number of holes being found is starting to exceed what people can read and judge one by one.

In the widely used PHP language, two serious vulnerabilities were found, and the PHP foundation announced them in advance and released fixes. Reports say an AI model found them. AI finds, people fix; so far so good. But posts also appeared saying that after the fix was published, AI agents were automatically attacking servers that had not yet applied it. Reading the fix reveals where the weakness was. The attacker's clock starts the moment a fix is out. While people hold a meeting and plan to respond next week, the other side is already searching automatically.

On the defending side, there were also voices saying that because they could not find maintenance staff, they had introduced autonomous AI defense. The very premise of hiring people to defend is starting to break down.

A common misconception: responding without understanding the content

The most common mistake in handling vulnerabilities is acting without understanding what they are. Every time, you should understand the vulnerability itself and act on the places likely to be affected. In reality, there are a great many cases of doing the wrong thing: stopping everything because it made the news, changing unrelated settings, while the places truly affected are left untouched. Acting without reading the content only adds work and does not strengthen defense.

The reason it goes off track is that people do not have time to read each one closely. A resident agent can read the vulnerability description, check which version of which of your systems it applies to, and list only the affected places.

What worked in my company, and what failed

In my company, we urgently updated our integrated business system that brings together device, license and security management. After handing this to resident agents, license management, PC version management, and checks on each account's two-factor authentication status and whether it is in use became immediately possible. If needed, accounts can be suspended right away. An inventory that people do once a year becomes an ordinary daily task for an agent. Above all, the biggest change was the peace of mind that a resident agent is always watching.

On the other hand, my biggest failure was the very idea of doing it by hand. In a society that assumes AI, I lacked the awareness that cyberattacks are also always happening. As long as the other side uses AI and never rests, defense must also always be running.

Four foundations to decide before handing it over

Overseas, the idea of an AI control plane is now drawing attention. Palo Alto Networks explains that you need not only to see AI access, usage, data and cost but to control them on the spot. Okta has also published questions that security leaders should answer about AI agents. I see this as the scaffolding for running resident agents safely, and I think of it in four parts.

The first is permissions. Decide what an agent may and may not do. NVIDIA's OpenShell was introduced as a system that denies agent permissions by default, monitors their actions and isolates them. Separate the permission to investigate from the permission to suspend, and give only the permissions needed, only as far as needed.

The second is monitoring. It means both the agent watching the company's systems 24 hours a day and watching the agent's own actions. It is the same idea as attaching operation logs and double checks to people with strong permissions.

The third is records. Keep in a fixed place which vulnerability it was, which version of which system the agent judged to be affected, and what it did. With records you can later confirm whether the response matched the content, and fix it next time if it did not.

The fourth is how to stop. Decide who stops the agent and how when it makes a mistake, and what is restored after it stops. Because you know it can be stopped and reversed, you can entrust strong permissions. Decide this one, without fail, before handing anything over.

My criterion: by default, hand it to resident agents

My criterion is clear: by default, I hand it to resident AI agents. My company is constantly integrating systems and building new ones, so it is simpler to think of resident agents as the main players first than to run defense alone by other people's hands. People decide, system by system, whether to keep it in-house or ride on a large platform, set the four foundations, and adjust the lines by reading the records. The human role does not disappear; it moves from the front line of defense to the design of defense. Smaller companies cannot assign dedicated security staff, so I think this approach matters even more for them.

"It's hard" will turn into position talk

To put it strongly, I think saying that cyberattack countermeasures are hard will turn into position talk on the human side. If you assume people run it by hand, defense is certainly hard. But if resident agents watch 24 hours a day, read the content and act on the affected places, much of the difficulty fades. It is better to accept what the name SI, superintelligence rather than AI, implies: that at least in this area of defense it surpasses humans, and to put it to use.

What you can do this week

List your company's systems and, for each one, write in a single line whether you will "hand it to resident AI in-house" or "ride on a giant platform." If you are unsure about some, write that down too. Then pick just one of the systems you decided to keep in-house and hand only vulnerability detection and reporting to a resident agent. At first, do not let it fix anything; just find and report. At the same time, decide permissions, monitoring, records and how to stop in one line each. After a week of reading the records, you will see how far you can entrust it.

▶ Watch the full video (Japanese)
https://www.youtube.com/watch?v=i36ILLrPhs4