Getty Images/iStockphoto
AI agents risk blind spots without shared security data, experts warn
Building a common, continuously updated view across security tools raises practical questions about data ownership, freshness and resolving disagreements.
A security tool reports that a server is patched, while another identifies it as vulnerable. This can leave analysts investigating which record is correct. However, an AI agent relying solely on one of those findings could recommend a response before that conflict is resolved.
When security tools contradict each other, is letting AI break the tie efficient automation -- or a disaster waiting to happen?
With organizations rapidly introducing agents into security operations, analysts and automated systems need access to the same asset identities, exposure information and business context. But combining records does not establish their accuracy. A shared view must preserve evidence, expose unresolved disagreements and carry corrections into decisions already underway.
Michelle Abraham, research vice president for security and trust at research firm IDC, said organizations should prioritize information that explains an asset's reachability, business importance, controls and current condition over vulnerability severity alone.
"An AI agent's recommendation is only as trustworthy as the asset inventory and control taxonomy feeding it," she explained.
Build a common foundation for decisions
Agents should seek additional information when the available evidence is insufficient, Abraham added, just as an analyst would. If further investigation remains inconclusive, the issue should be escalated to a human reviewer.
The shared data layer should consistently identify each asset and link it to business and technical owners, services, exposure, compensating controls and exceptions. Freshness should be tracked explicitly, while raw data can remain in the underlying tools.
Security should own the system that reconciles those records, Abraham said, but responsibility for individual facts remains distributed. Business owners understand service criticality and accepted risks; technical owners maintain information about software, reachability and vulnerabilities.
"When updates are required, the data layer has to be corrected, not the dashboard layer," she said.
She recommended bidirectional connections among asset management, security monitoring and exposure management systems so corrections do not require separate manual updates. Otherwise, a dashboard can display an amended record while another tool continues supplying an agent with the earlier version.
Preserve conflicts and recheck changing conditions
Some apparent disagreements reflect different aspects of the same risk, said Diana Kelley, CISO at AI security and governance specialist Noma Security.
A vulnerable system can also be effectively isolated from the network. Both findings may be accurate, and the assessment needs to account for them together. A contradictory patch status requires investigation into the asset identity, software version, evidence source and observation time.
"A newer timestamp alone does not make a finding correct," she said.
The shared view should retain unresolved conflicts and provide access to the underlying evidence. Analysts and agents need to understand why a recommendation was made, rather than receive a risk score stripped of its supporting facts.
Freshness requirements should also reflect how quickly a condition changes and the consequences of acting on it. An asset's owner may remain unchanged for months; network exposure can change within a minute.
"Check when the condition was observed, not just when the dashboard updated," Kelley said.
Before shutting down a service or quarantining an endpoint, an agent should recheck the relevant evidence. If that is impossible, organizations need a predefined fallback, such as an incident-commander review or an approved, reversible response.
Corrections must reach cached data and the context an agent is using, Kelley added. Pending actions based on a corrected fact should be reconsidered, with a record of what changed and which earlier decisions relied on it.
Require independent evidence before disruptive action
A common data foundation can also spread a mistake if several agents treat copies of the same observation as separate confirmations.
Andrew Moore, co-founder and CEO of Lovelace, said agents should maintain multiple evidence chains and check that their sources are independent.
"If you have three independent corroborated chains of reasoning, that is vastly higher fidelity than just one," he noted.
He distinguished monitoring from acting. A monitoring agent might investigate a single indication of an attack, while a consequential response requires stronger corroboration. Multiple agents repeating a single source's conclusion do not confer that independence.
Moore cautioned against giving agents direct control over significant actions except where an attack unfolds too quickly for human intervention. In those cases, he recommended narrowly defined playbooks rehearsed through simulation and incident-response exercises.
The permitted actions should be specific, he said, rather than leave an autonomous agent free to improvise a disruptive response. He also recommended a separate coordination agent to assess probabilities and audit whether information sources are independent.
Test accuracy against known outcomes
Organizations need to establish whether shared information improves decisions, rather than simply making responses more consistent.
Ram Varadarajan, CEO of Acalvio, a threat detection vendor, recommended comparing decisions made with and without the shared view against facts established through incident reviews, red-team exercises, deliberately introduced faults and decoy assets with known states.
Measures should include decision accuracy, time to correct action and how often decisions are reversed or overridden.
"Crucially, I'd also track whether independent evidence sources continue to disagree with the consensus," Varadarajan said.
That check can reveal correlated errors that apparent agreement conceals. He also recommended recording the age of evidence behind each decision and requiring agents to refuse or escalate actions when freshness limits are exceeded.
Abraham noted that when updates are required, the data layer must be corrected, not the dashboard layer.
She explained organizations need to connect to other systems to ensure a bidirectional flow of data across all systems that use asset data, such as CMDB/ITAM for asset management, SIEM/SOAR for alert context, and exposure management for prioritization of remediation work, rather than requiring each to be updated separately.
Make agents reconsider corrected evidence
Aviv Nahum, co-founder and CEO of Above Security, a company focused on managing insider risk, said a shared view should connect identities, assets, business data and event sequences without becoming another repository for all security telemetry.
The underlying systems can retain detailed records, while the shared layer preserves their origin, timing and the evidence supporting an interpretation.
"Sometimes the correct conclusion is that the evidence is insufficient," Nahum said.
He recommended measuring the accuracy of investigations, false positives, reproducibility and unnecessary disruption. Organizations should also check whether an analyst's correction or contradictory telemetry changes an agent's conclusion.
A system that continues repeating its original assessment after the supporting facts change can keep directing responders toward the wrong action, even when updated information is available.
"The most important test is whether the system can change its mind when new evidence arrives," Nahum said.
Nathan Eddy covers IT trends and technologies across multiple industries. Eddy is a graduate of Northwestern University's Medill School of Journalism.
