AI agent re-grades cloud security alerts using deployment context

Sola Security researchers built an AI agent to reassess high-severity findings from third-party cloud security platforms. Across 9,967 HIGH findings in eight production environments, the agent changed 75.1% of grades, lowering 58.5% and raising 16.6%. The study argues that static rule-based severity misses environmental context, and the agent requires stronger evidence to raise a grade than to lower one.

Sola Security's Leon Goldberg and Gal Engelberg created an agent that re-evaluates alerts from external cloud security tools. In tests across eight production environments, it reviewed 9,967 high-severity findings from two commercial platforms. The agent altered 75.1% of ratings: 58.5% went down and 16.6% went up. Separately, 599 vendor rules each produced a single severity across 99,073 failing findings, showing rule-based grades do not vary by deployment.

The agent's reasoning often depended on context beyond the flagged resource: 49.0% of decisions used evidence from connected assets or other security products. Six patterns recurred, with inert or unattached resources the largest at 32.3%. Among 138 rules, 62 yielded both downgrades and upgrades; for 57, both occurred in one environment. Read-only probes on eight AWS accounts matched the agent's facts 99.4% of the time.

Count words. First para: Sola(1) Security's2 Leon3 Goldberg4 and5 Gal6 Engelberg7 created8 an9 agent10 that11 re-evaluates12 alerts13 from14 external15 cloud16 security17 tools18. In19 tests20 across21 eight22 production23 environments24, it25 reviewed26 9,96727 high-severity28 findings29 from30 two31 commercial32 platforms33. The34 agent35 altered36 75.1%37 of38 ratings39: 58.5%40 went41 down42 and43 16.6%44 went45 up46. Separately47, 59948 vendor49 rules50 each51 produced52 a53 single54 severity55 across56 99,07357 failing58 findings59, showing60 rule-based61 grades62 do63 not64 vary65 by66 deployment67