Figma uses AI agents to automate security investigations and vulnerability detection

AI Agents Enhance Security Operations

Figma's engineering team implemented AI agents to support its security team in investigating alerts, searching past incidents, checking company systems, and preparing code fixes. These agents learn from previous investigations, which reduces repetitive tasks and helps engineers resolve complex alerts faster.

Improved Efficiency and Vulnerability Detection

The AI-driven system reduced the resolution time for complex alerts by approximately 70% and decreased on-call pages by 20%. Additionally, the agents found over 100 previously unknown vulnerabilities, including two critical flaws that traditional tools missed. A code reviewer agent achieved 80% precision within a month, and the system improved detection of known bugs by about 30%.

System Architecture and Components

The security system is built on Panther SIEM and investigates alerts and audit logs across AWS, Okta, GitHub, GCP, and osquery. It queries more than 100 other sources and can open pull requests. The alert triage agent uses models like Claude Opus and is provided with Slack thread history, steering memory, and tools for security on-call engineers.

The agentic system incorporates AWS Bedrock Knowledge Bases, Amazon Kendra, Tines, and a Snowflake-based tool to search historical alerts and analyze Panther data. Memory, including past alerts, behavioral guidance, and learned database structures, was critical for the system's effectiveness.

Safety Controls and Impact

Safety controls are integrated into the tools, with agent-created pull requests set to draft by default. Prompts are designed to prevent sensitive data from being shared in public Slack channels. This implementation demonstrates how AI agents can significantly enhance security posture and operational efficiency within a software company.