Security response agents won't hunt without a loud signal

SecRespond finds security response agents rarely hunt intrusions without a loud signal, per a new arXiv benchmark. That's a problem for anyone using an agent to watch their own agent infrastructure.

A quiet compromise, one that doesn't trip an alert, can sit there until a human notices it and points the agent at it directly.

A separate post-mortem on a July intrusion makes the same case from a real breach, not a lab test. Its argument: skip putting an agent on detection duty for your own agent infrastructure unless a human runs the hunt underneath it.

This review draws only on the paper's abstract. It's not clear which attack types or environments SecRespond tested, or how big the gap is between prompted and unprompted investigation.

Treat an incident-response agent as a responder, not a hunter. It'll work a case once you flag it. It won't go looking for one on its own.