Your AI agent is only as good as your endpoint data
PARTNER CONTENT: Real-time endpoint data keeps AI-driven IT operations accurate, fast and under control
A recent set of critical flaws in PHP demonstrated the rapid shift in IT and security landscapes. While the flaws were quickly patched, many teams struggled to respond at such a swift pace. This led to the question of what it takes to achieve governed autonomous IT, where software can find risks, rank their importance, propose fixes, and execute them under certain limits.
A loop is envisioned where software spot a risk, propose a fix, execute it within defined limits, and verify its effectiveness. The process leaves a record for review and reversal.
Three challenges consistently arise: visibility, tool-hopping, and pace. PHP2Shell, for instance, went undetected for over a decade, highlighting the importance of visibility. Finding every copy of PHP across various platforms and determining their internet accessibility proved challenging. Additionally, coordinating data from different sources like asset inventories, vulnerability scanners, and attack surface tools added to the delay.
The third challenge, pace, was evident as several security firms detected exploitation attempts before PHP released its fixes.
To make autonomous IT trustworthy, real-time endpoint data is crucial. Four qualities contribute to this: accuracy (live data, not snapshots), speed (short path from question to action), control (approvals, audit trails, and rollback), and shared truth (single view among IT operations, security, and the system of record). Matt Psencik, a threat research engineer at Tanium, emphasized the importance of visibility, stating, "The installations that worry me most are the ones a security team doesn't know it owns."
AI plays a dual role in this scenario. It assists researchers in identifying flaws, as seen in the discovery of PHP2Shell, while attackers can also leverage AI for building exploits. For defenders, AI functions best as an operator and interface, taking plain-language questions, determining necessary data queries, and proposing or executing the next steps.
However, the quality of AI's output hinges on the reliability of the data it relies on. An AI-generated answer based on outdated information remains incorrect, albeit more confidently.
Practical first steps for teams include finding every copy of software, ranking systems based on internet accessibility, and piloting low-risk workflows with approval mechanisms and audit trails. Tanium Atlas, a solution built to address the tool-hopping problem, enables operators to ask plain-language questions, receive answers from live endpoint data, and act within set limits, with every action recorded.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
