When cybersecurity experts set out to build an agentic pipeline at Sovera Security, one thing quickly becomes clear: the hardest problems are not really about AI. Zero trust, least privilege, alignment, continuous validation, optimization, and cost efficiency have to come first. AI comes after all of them.
These principles guide how we design an AI-driven MDR that can operate safely, efficiently, and at scale.
Least Privilege, Least Interface
We never set AI free inside a cybersecurity workflow. Security analysts operate with limited access to data sources, tools, and customer environments. AI agents should inherit those same constraints and receive access only to what their assigned task requires.
When an agent needs a new API, data source, or tool, it submits a request for human review and approval, much like a new employee requesting additional access. Capability should never imply unrestricted access.
.png)
Zero Trust
We treat AI agents the way we would treat a newly hired analyst: capable, but unproven and not yet trusted with the keys to everything.
Trust should be earned through a track record, not granted by default. An allowlist approach is the starting point. Key rotation is mandatory. Comprehensive auditing is built into the system. Requests for broader permissions require approval.
The result is an environment where agents have the access they need without accumulating unnecessary privilege.
Platform-Enforced Constitutions
We do not give AI agents a set of rules and simply hope they follow them.
Prompt-based instructions are not a sufficient security boundary because the same model reading those instructions may also be processing adversarial input intended to manipulate its behavior. Critical constraints therefore need to live outside the model and be enforced by the platform.
For us, that includes principles such as:
- Tenant segregation. Agents never specify a tenant ID in their requests. Each operates inside an isolated environment with access to only one tenant.
- Credential management. Agents never see, select, or provide credentials. The platform injects the appropriate credentials when communicating with an external system.
- Universal anonymization. When sensitive data leaves a tenant environment, the platform anonymizes it automatically without requiring agent involvement.
Security should not depend on the model remembering to behave securely.
Deterministic Orchestration and Evaluation
Workflows should remain deterministic whenever the underlying logic is already known. We do not ask an AI agent to calculate something that can be handled reliably by code. We write the loop or build the function, then allow the agent to operate within that structure.
AI should handle ambiguity, interpretation, investigation, and reasoning. Code should handle logic that is already well defined. This improves reliability while making agent behavior easier to test, evaluate, and audit.
Memory Is an Attack Surface
AI agents need to learn from failures, identify optimization opportunities, and apply established best practices. But memory itself introduces risk. The moment an agent learns to dismiss a pattern as a false positive may be the moment a threat actor starts using that same pattern in a real campaign.
Agent memory therefore cannot become an uncontrolled collection of historical conclusions. Every memory needs defined provenance, ownership, scope, confidence, and lifecycle management, along with testing, validation, expiration, and cleanup. What an agent learns should be governed as carefully as what it can access.
Continuous Optimization
Defining the right boundaries for AI agents is an ongoing challenge. As models become more capable, overly specific prompts can sometimes make them less effective. Too much control limits their ability to reason through unfamiliar situations. Too little can make workflows unpredictable or unsafe.
The goal is to continuously find the right balance between deterministic and non-deterministic behavior. That balance will change as models improve. A task that requires tightly constrained orchestration today may be safely delegated to a more capable model tomorrow.
Continuous optimization is therefore part of the architecture, not a one-time tuning exercise.
Model Hierarchy
A cybersecurity agentic pipeline also has to be cost efficient. Otherwise, it inherits one of the most damaging bottlenecks of the traditional SOC: de-prioritization.
When investigation is expensive, teams inevitably decide which alerts deserve attention and which can be ignored. AI should reduce that constraint, not reproduce it. A model hierarchy assigns the right model to the right task based on capability, complexity, and cost.
Lightweight models can handle high-volume routine work so incidents are not left uninvestigated simply because they appear insignificant at first glance. More capable models can step in when investigations require deeper reasoning, orchestration, or judgment. The most capable models should be reserved for the highest-leverage work, including improving the system itself rather than repeatedly processing routine cases.
The objective is not to use the most powerful model everywhere. It is to make advanced reasoning available across the operation without allowing cost to become another form of prioritization.
Model Integration Patterns
A model hierarchy does not mean every model operates independently.
Different models can contribute different strengths to the same investigation. One model might investigate while another evaluates its conclusion. Multiple models might produce independent verdicts that are reconciled before action is taken. In other cases, models may collaborate on different parts of the same investigation, with a more capable model coordinating their work.
The important question is not which single model should own the workflow. It is how models, deterministic systems, and human analysts can work together to produce a better outcome than any one component could achieve alone.
Building Security Around AI
AI can fundamentally change how managed detection and response operates, but only if the surrounding system is designed to support it.
The goal is not to bolt an LLM onto an existing SOC process and call it AI-driven MDR. It is to rethink how work should be divided across deterministic software, AI models, and human expertise. That means constraining agents before expanding autonomy, enforcing security at the platform layer, governing memory as infrastructure, matching model capability to the economics of the task, and continuously validating how the system behaves.
The models will keep improving. The architecture around them is what determines whether those improvements translate into a security operation that is safer, more scalable, and more effective.