Episode Details
Back to Episodes
Beyond the Prompt: Building the Security Agent Fabric
Published 1 month, 2 weeks ago
Description
What if the biggest bottleneck in your Security Operations Center isn't your technology stack—but the humans forced to orchestrate it?In this episode of the M365.fm Podcast, we explore one of the most important shifts happening in cybersecurity today: the rise of Agentic Defense and the emergence of the Security Agent Fabric.For years, organizations have tried to solve security challenges by adding more tools, generating more alerts, and hiring more analysts. Yet burnout continues to rise, alert fatigue remains a critical issue, and attackers continue to exploit the gaps created by human bottlenecks.The reality is simple: modern security environments generate far more signals than humans can realistically process. Cloud platforms, hybrid environments, identity systems, endpoints, and applications all produce enormous amounts of telemetry. The traditional SOC model wasn't designed for this scale.This episode examines how security teams are moving beyond simple automation and toward intelligent agent orchestration, where AI-powered security agents enrich, correlate, validate, and even act on security signals while keeping humans focused on high-value decisions.
THE HUMAN MIDDLEWARE PROBLEM
One of the most thought-provoking concepts discussed is the idea of "human middleware."Most analysts spend a significant portion of their day opening alerts, gathering context, enriching incidents, switching between tools, and manually correlating data. Instead of focusing on risk reduction, they become the orchestration layer connecting disconnected systems.We discuss why this architecture is fundamentally unsustainable and how agentic systems can remove repetitive work from analysts while improving consistency, speed, and security outcomes.
WHY MTTR IS THE WRONG SECURITY METRIC
Security leaders often focus on Mean Time To Respond (MTTR), but does closing tickets faster actually make organizations safer?This conversation explores why traditional SOC metrics can incentivize the wrong behaviors and why dwell time—the amount of time attackers remain undetected inside an environment—may be a far more valuable measure of security effectiveness.Rather than optimizing for ticket closure, modern security operations must optimize for risk reduction, validation, and threat containment.
FROM SECURITY COPILOTS TO AUTONOMOUS AGENTS
The episode dives deep into the evolution from AI assistants to fully autonomous security agents.We explore:
• Assistive AI systems that recommend actions
• Semi-autonomous agents that execute low-risk decisions
• Fully autonomous workflows operating inside governance boundaries
• Human oversight models for high-impact security actions
• Building trust through transparency and explainable reasoning
Understanding where your organization sits on this autonomy spectrum may determine how quickly you can scale security operations in the years ahead.
REAL-WORLD SECURITY AGENT USE CASES
The discussion includes practical examples of agentic security workflows already delivering measurable results today.Topics include:
• Phishing triage agents
• EDR alert investigation agents
• Identity protection agents
• Conditional Access optimization agents
• Cloud security validation agents
You'll learn how organizations are achieving dramatic reductions in analyst workload while improving detection accuracy and reducing attacker dwell time.
THE POWER OF MULTI-AGENT ARCHITECTURES
One of the most fascinating sections of the conversation examines Microsoft's MDASH framework and why the future of security AI isn't about building bigger models.Instead, success comes from orchestration.Specialized agents perform distinct functions including:
• Discovery and scanning
• Validation and adversarial review
• Proof generation
THE HUMAN MIDDLEWARE PROBLEM
One of the most thought-provoking concepts discussed is the idea of "human middleware."Most analysts spend a significant portion of their day opening alerts, gathering context, enriching incidents, switching between tools, and manually correlating data. Instead of focusing on risk reduction, they become the orchestration layer connecting disconnected systems.We discuss why this architecture is fundamentally unsustainable and how agentic systems can remove repetitive work from analysts while improving consistency, speed, and security outcomes.
WHY MTTR IS THE WRONG SECURITY METRIC
Security leaders often focus on Mean Time To Respond (MTTR), but does closing tickets faster actually make organizations safer?This conversation explores why traditional SOC metrics can incentivize the wrong behaviors and why dwell time—the amount of time attackers remain undetected inside an environment—may be a far more valuable measure of security effectiveness.Rather than optimizing for ticket closure, modern security operations must optimize for risk reduction, validation, and threat containment.
FROM SECURITY COPILOTS TO AUTONOMOUS AGENTS
The episode dives deep into the evolution from AI assistants to fully autonomous security agents.We explore:
• Assistive AI systems that recommend actions
• Semi-autonomous agents that execute low-risk decisions
• Fully autonomous workflows operating inside governance boundaries
• Human oversight models for high-impact security actions
• Building trust through transparency and explainable reasoning
Understanding where your organization sits on this autonomy spectrum may determine how quickly you can scale security operations in the years ahead.
REAL-WORLD SECURITY AGENT USE CASES
The discussion includes practical examples of agentic security workflows already delivering measurable results today.Topics include:
• Phishing triage agents
• EDR alert investigation agents
• Identity protection agents
• Conditional Access optimization agents
• Cloud security validation agents
You'll learn how organizations are achieving dramatic reductions in analyst workload while improving detection accuracy and reducing attacker dwell time.
THE POWER OF MULTI-AGENT ARCHITECTURES
One of the most fascinating sections of the conversation examines Microsoft's MDASH framework and why the future of security AI isn't about building bigger models.Instead, success comes from orchestration.Specialized agents perform distinct functions including:
• Discovery and scanning
• Validation and adversarial review
• Proof generation