SECURITY Signal 75
Figma deploys AI agents to automate security alert triage and code fixes with human oversight
↗
Figma’s engineering team built AI agents to investigate security alerts, search past incidents, and prepare code fixes, reducing resolution time by 70% for complex alerts while maintaining human review controls.
AI-driven security automation can significantly reduce repetitive work and accelerate incident response, but it requires strict controls to prevent errors or misuse. This approach highlights the balance between efficiency gains and the need for human oversight in critical workflows.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
AI agents at Figma investigate alerts, query audit logs, and draft code fixes, cutting resolution time by 70% for complex security issues.
The system uses memory from past incidents and behavioral guidance to improve accuracy over time, with safety controls like draft-only PRs and restricted data sharing.
While the agents found over 100 vulnerabilities and improved bug detection by 30%, precision was prioritized over recall to avoid false positives.
THE READ
What the cluster adds up to.
Figma’s implementation of AI agents for security operations demonstrates a shift toward automation in alert triage and incident response. The agents integrate with tools like Panther SIEM, AWS Bedrock, and Snowflake to query logs across AWS, Okta, GitHub, and other platforms, reducing manual effort for repetitive tasks. By learning from past investigations, the system aims to improve efficiency without fully replacing human judgment, though its effectiveness depends on the quality of historical data and the precision of its memory mechanisms.
The agents’ ability to draft code fixes and open pull requests introduces a new layer of automation in security workflows, but it also raises questions about trust and oversight. Figma mitigates risks by defaulting agent-generated PRs to draft status and restricting sensitive data sharing, but the system’s reliance on models like Claude Opus means its outputs are only as reliable as the training data and prompts. The 70% reduction in resolution time for complex alerts suggests measurable gains, but the trade-off between speed and accuracy remains a key consideration for teams adopting similar tools.
Figma’s approach prioritizes precision over recall, a counterintuitive but practical strategy given the limitations of historical bug data. The agents identified over 100 previously unknown vulnerabilities, including critical flaws missed by traditional tools, but the system’s success hinges on continuous feedback loops and human review. The warning that implementation specifics vary by company size and risk profile underscores that this is not a one-size-fits-all solution. Teams must weigh the benefits of automation against the need for customization and ongoing oversight.
The broader implications of AI-driven security automation extend beyond Figma’s use case. The referenced Wiz report on malicious repositories tricking AI coding assistants highlights the potential for adversarial attacks, while OpenAI’s sandbox escape disclosures emphasize the fragility of even well-designed systems. Figma’s acknowledgment that neither AI nor humans are perfect suggests that the future of security operations lies in hybrid models, where automation handles routine tasks and humans focus on high-stakes decisions. The challenge will be defining where the boundary between the two should lie.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER