Notifications
Clear all
Topic starter
18/08/2026 2:18 pm
TL;DR: As intelligence becomes more abundant and zero-day exploitation accelerates from 23 days to 20 hours, SecOps will need agents that operate as software in context-rich workflows rather than as role-scoped human proxies, according to Cotool. The implication is that threat hunting, detection tuning, and investigation orchestration now depend on environment-specific mandate, telemetry, and human oversight, not static rules.
NHIMG editorial — based on content published by Cotool: agentic threat hunting and contextual intelligence for SecOps
By the numbers:
- The mean time to exploit zero-day vulnerabilities has dropped from 23 days in 2025 to 20 hours in 2026.
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI agents complicate access governance more than ordinary automation?
A: AI agents complicate access governance because they can branch at runtime, wait on external services, and continue later with the same operational context.
Q: What do teams get wrong about role-scoped security agents?
A: They often assume a human job title maps cleanly to a machine task.
Practitioner guidance
- Define agent purpose and permitted actions Write a short mandate for each security agent that specifies the investigation goal, allowed data sources, and prohibited actions.
- Scope every agent with least privilege Assign each agent only the SIEM, endpoint, auth, and cloud permissions it truly needs for its task.
- Separate scheduled detection from continuous hunting Use different runbooks, approvals, and monitoring for trigger-based triage agents and orchestrated hunting agents.
What's in the full article
Cotool's full blog post covers the operational detail this post intentionally leaves for the source:
- How the orchestrator decides which agents to spawn, including intent, tools, and execution cadence
- Examples of how detection agents tune noisy alerts and feed false-positive feedback back into the context layer
- The telemetry inputs used to build the environment threat model, including SIEM, endpoint, auth, and cloud signals
- Why the vendor sees agents-as-software as better suited to proactive investigations than role-scoped human proxies
👉 Read Cotool's analysis of agentic threat hunting and SecOps orchestration →
Agentic threat hunting: what it means for SecOps teams?
Explore further
18/08/2026 3:10 pm
Agentic SecOps is creating a new non-human identity governance problem. Once agents can query live telemetry, spawn sub-agents, and adapt their investigation path, they stop looking like simple automation and start behaving like governed actors. That means access scope, intent, and traceability become first-class controls, not implementation details. For identity teams, the lesson is straightforward: if an agent can touch production systems, it needs an identity model that is explicit, bounded, and reviewable.
A question worth separating out:
Q: Who is accountable when an AI agent causes a security incident?
A: Accountability should sit with the business owner, the system owner, and the security function together, because agent behaviour crosses operational boundaries. Organisations need a defined owner for approval, monitoring, and retirement, plus audit evidence that shows what the agent accessed and why.
👉 Read our full editorial: Agentic threat hunting is shifting SecOps from rules to context
