AI Agent Re-evaluates Cloud Security Findings, Reducing Alert Fatigue
A new AI agent developed by Sola Security can re-evaluate high-severity cloud security findings, downgrading many to reduce alert fatigue and improve prioritization.
Cloud security platforms often generate a high volume of findings, overwhelming security teams with alerts that may not always reflect the true risk in a specific environment. Recognizing this challenge, researchers at Sola Security have developed an artificial intelligence agent designed to re-assess the severity of these findings, aiming to filter out noise and highlight genuine threats.
The AI agent was tested on 9,967 high-severity findings from two commercial cloud security platforms across eight production environments. The results indicated that the agent successfully re-graded 75.1% of these findings. Notably, 58.5% were downgraded, while 16.6% were upgraded, suggesting that automated, context-aware analysis can significantly refine the prioritization of security alerts.
Traditionally, the severity of cloud security findings is determined by static rules, which assign a universal risk level regardless of the specific deployment context. This approach fails to account for environmental factors such as whether a flagged resource is actively in use, connected to other systems, or protected by existing security controls. The Sola Security researchers argue that this static method leaves a crucial gap in risk assessment, as it doesn't incorporate the specific environmental metrics that are vital for accurate CVSS scoring and NIST risk assessments.
To address this, Sola Security's AI agent analyzes each finding by forming a theory of potential exploitation and then gathering evidence directly from the cloud environment. This evidence includes the configuration of the flagged resource, its connections to other resources, and data from other security products. The agent's policy dictates that downgrading a finding requires evidence of an offsetting factor, while upgrading necessitates proof of increased risk in the specific environment, considering potential guardrails like firewalls or allowlists.
Analysis revealed recurring patterns that influenced the agent's severity re-evaluations. Inert resources, those not connected to anything or orphaned, were a significant factor in downgrades. Other common reasons for lowering severity included resources being unreachable from the internet, lacking active services, or being protected by account-level blocks. Conversely, findings indicating confirmed public exposure often led to severity upgrades.
Interestingly, the study found that the same security rule could lead to both downgraded and upgraded findings, depending on the specific environmental context. For example, a security group rule might be downgraded if the group only protected internal resources but upgraded if it was exposed to the internet. This highlights the dynamic nature of cloud security risk and the limitations of static rule-based assessments.
The researchers also validated the accuracy of the agent's findings by running read-only probes on eight AWS accounts. The live environment data matched the agent's collected facts in 99.4% of cases where the probes could settle the verdict. While this study focused on the 'reading' aspect of AI in security—verifying findings—the authors emphasize that 'acting' on these findings autonomously requires further considerations regarding blast radius, reversibility, and authorization.
While the study primarily focused on AWS environments and high-severity findings from two platforms, its implications are significant. By demonstrating that AI can effectively re-contextualize security alerts, this research points towards a future where security teams can better manage alert fatigue, focus on critical vulnerabilities, and improve their overall security posture in complex cloud environments.