Salt Security has expanded its Agentic Security Platform with Autonomous Defence, a set of capabilities designed to automate threat containment, enforcement, and remediation. The update targets the operational lag between detecting a risk and actually stopping it, a window that attackers increasingly exploit at machine speed.
What happened
- New Autonomous Defence capabilities automate blocking, access revocation, and configuration changes
- Works through existing enterprise tools including WAFs, API gateways, and SIEMs
- Visual drag-and-drop workflow builder with over 200 pre-built connectors
- Customers choose which findings trigger immediate action versus approval workflows
- Available now to existing Salt Security customers with migration support
Background: the detection-to-response gap
Security teams have long relied on manual handovers across disconnected systems. An alert fires, a ticket gets created, an analyst investigates, approvals are sought, and only then does enforcement happen. According to itsecurityguru.org, Salt argues this "ticket speed" is fundamentally mismatched against attackers who move at "machine speed." The problem compounds as AI accelerates both the discovery and exploitation of vulnerabilities in APIs and agentic systems.
Prnewswire.com reported the same announcement with additional detail on native AI Detection and Response (AI-DR) capabilities. These provide real-time LLM protection against direct and indirect prompt injection, jailbreak attempts, and unsafe model behavior. The company cites OWASP's 2026 Top 10 for LLM Applications, where prompt injection ranks as the top risk. Salt's 2H 2026 State of Agentic AI and API Security survey found nearly half of organizations (49.8%) confirmed or suspected an AI agent took an unauthorized action in the past year, while only 12.5% can consistently trace an agent's full path from initial prompt through MCP servers and downstream APIs.
Why this matters for security operations
The core tension in security automation has always been speed versus control. Fully automated responses risk breaking production systems or blocking legitimate traffic. Fully manual responses guarantee control but fail against automated attacks. Salt's approach attempts a middle ground: a visual workflow builder that lets teams codify their response logic once, then execute it at machine speed while maintaining audit trails and approval gates for sensitive operations.
This matters because the attack surface has fundamentally shifted. AI agents now connect models to tools, MCP servers, and business APIs. An attack that starts as a malicious prompt can traverse these layers, reaching payment systems, customer databases, or infrastructure controls. Prnewswire.com described an example where a billing agent is tricked into revealing a refund tool on an MCP server, enabling unauthorized refunds through the downstream API. Traditional tools see either the prompt injection or the API attack, rarely both as a connected chain.
The platform's Agentic Security Graph maps these relationships, connecting agents to models, MCP servers, tools, and downstream APIs with context from source code, configurations, and runtime behavior. This unified visibility extends to existing AI guardrails across cloud platforms, endpoint solutions, SASE, AI gateways, and managed services. Where coverage gaps exist—including homegrown agents running in Kubernetes—Salt can fill them with native AI-DR.
Worked example: containing a compromised AI agent
Imagine a customer support agent with access to an order management API via an MCP server. An attacker crafts an indirect prompt injection hidden in a support ticket, instructing the agent to enumerate available tools and then invoke a refund function with elevated parameters.
Without autonomous defence: The prompt injection triggers an alert in the LLM guardrail. The API anomaly triggers a separate alert in the WAF. Analysts correlate these manually, file tickets, and request approval to revoke the agent's MCP credentials. Hours pass. The attacker iterates.
With autonomous defence: The Agentic Security Graph already maps the agent-to-MCP-to-API path. The workflow builder has a pre-approved playbook: "On confirmed prompt injection with downstream API anomaly, quarantine the MCP connection and push blocking rules to the API gateway." Execution takes seconds. The audit trail shows exactly what fired, what executed, and what requires post-action review.
What to watch next
Adoption will hinge on trust in the workflow logic. Teams need confidence that automated actions won't cause outages or data loss. Watch for real-world metrics on false positive rates, mean time to containment, and how organizations tune approval thresholds over time. The migration path for existing Salt Workflows customers will also signal how smoothly the new experience integrates with established processes.
Key takeaways
- Autonomous defence aims to eliminate the manual handover delay that lets attacks spread
- Unified visibility across LLM, MCP, and API layers addresses a genuine blind spot
- Success depends on organizations investing in workflow design and approval governance
Frequently asked questions
What is the difference between AG-DR and AI-DR?
AG-DR (Agentic Detection and Response) covers the full agentic path including MCP servers and downstream APIs. AI-DR (AI Detection and Response) is the new native LLM runtime protection layer built into AG-DR that handles prompt injection, jailbreaks, and unsafe model behavior in real time.
Does this replace existing WAFs, API gateways, or SIEMs?
No. The platform connects to these enforcement points through over 200 out-of-the-box connectors. It pushes blocking rules and enriches tickets but does not replace the underlying infrastructure.
How does the approval workflow function for sensitive actions?
Customers configure which findings trigger immediate automated action versus which require human approval. All actions, whether automated or approved, generate audit trails and can enrich SIEM events.
What data sources feed the Agentic Security Graph?
The graph connects AI agents, MCP servers, tools, and downstream APIs with context from source code, configurations, exposure data, and runtime behavior to map potentially dangerous paths.
Is this available for new customers only?
According to itsecurityguru.org, Salt Workflows is available to existing Salt Security customers now, with the company migrating existing workflows to the new experience and supporting customer-specific requirements.