How Figma Uses AI Agents for Security

The engineering team at software company Figma recently documented how they built AI agents to help their security team investigate alerts, search past incidents, check company systems, and even prepare code fixes. The agents learn from previous investigations, reducing repetitive work and helping engineers resolve complex alerts about 70% faster, while human review and strict controls remain in place.

Source: Figma blog

The team describes a security system built on Panther SIEM that investigates alerts and checks audit logs across AWS, Okta, GitHub, GCP, and osquery, an open-source tool that lets you query computers for security and system information using SQL. It queries more than 100 other sources and can open PRs.

The authors report that this reduced resolution time by about 70% for complex alerts and reduced on-call pages by 20% by lowering the severity of some alerts. Matthew Sullivan, formerly a security engineer at Figma and now at Nition, and Brad Girardeau, security engineering manager at Figma, write:

The alert triage agent (using a model like Claude Opus) is where most of the investigation happens. It receives the full Slack thread history as context, its own steering memory (more on this later), and a set of tools scoped to what a security on-call engineer typically needs during triage.