Topic starter
11/11/2026 6:01 pm
TL;DR: 26 LLM steps and 40 tool calls characterize the average task in ProjectDiscovery’s engineering data, while longer runs stretched to 14.7 hours and 2,398 tool calls. Agentic security workflows need phase boundaries and verification loops because raw delegation alone cannot preserve evidence quality at scale.
Editorial analysis by NHI Mgmt Group, based on content published by ProjectDiscovery: “How Neo's Agent Architecture Evolved: From One Agent → Plan, Execute & Verify”.
By the numbers:
- Average tasks hit 26 LLM steps and 40 tool calls.
- The same architecture carried single runs up to 14.7 hours, 2,154 steps and 2,398 tool calls.
Key questions
Q: Why do multi-agent systems need structured handoffs?
A: Multi-agent systems need structured handoffs so each agent passes state, intent, and constraints in a machine-readable form instead of relying on implicit context.
Q: How does verification reduce false positives in agentic workflows?
A: Verification reduces false positives when a separate pass checks the agent’s output against source data, policy, or a second model before action is taken.
Q: What should teams do first when an AI agent needs long-running task execution?
A: Start with task decomposition: split the long-running goal into bounded steps, define the agent’s allowed tools and data, and assign a human owner for review and escalation.
Practitioner guidance
- Define hard phase boundaries for agentic workflows Separate planning, execution and verification into distinct runtime stages with different success criteria, budgets and exit conditions.
- Require structured handoffs between subagents Make every delegated worker return a fixed summary, evidence pointer and completion status so the orchestrator can reason about what happened.
- Preserve working state outside the model context Store plans, intermediate findings and verification artefacts in durable task state so long-running jobs do not depend on context window retention alone.
Bottom line: Agentic security workflows break down when one loop is asked to investigate, decide and verify at the same time.
Glossary terms: Agentic workflow, Orchestrator, Verification loop, Evidence Decay
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Plan, execute and verify is a governance pattern, not just an engineering pattern. Once delegated work can run for hours and fan out across specialised agents, the control question shifts from “can the agent do the task?” to “can the system prove the task was done correctly?”. That is a direct identity and authority problem because each subagent operates with scoped tool access and must return trustworthy state. Practitioners should treat phase boundaries, summaries and verification gates as governance primitives, not implementation footnotes.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: When should security teams choose an orchestrated agent over a single agent loop?
A: Choose an orchestrated agent when the work needs coordination across tools, branching steps, or multiple specialised agents under one control plane. A single agent loop fits narrow, self-contained tasks, while orchestration is better for enforcing approvals, retry logic, observability, and bounded delegation across longer workflows.
👉 Read our full editorial: Plan, execute and verify makes agentic security work governable