Skip to content
IOmergent
Talk to us
Home Fractional CISO Managed Cloud Security Solutions Industries Resources About Talk to a CISO

AI Security Reference ArchitecturesTrack B: Agent runtimes

B2 Vendor-Run Agents

B2 covers AI agents a vendor runs with standing access to your systems: AI SOC analysts and AI SRE or on-call agents. The product is bought; the controls are yours at the integration. Give each vendor its own read-only role or API client, add write actions one at a time behind an analyst's approval, and keep your own record of every call it makes. The risk that matters most is the vendor's stored credentials, not the model.

Mostly buy Owner: Security + platform eng Control: Med Stand up: 1 to 6 wks

Who it fits: Companies that buy an AI SOC analyst or an AI SRE or on-call agent. The vendor runs the agent and holds standing access to your EDR, identity provider or cloud, so one stolen vendor token reaches the whole company. You control the grant, approval for actions and your own record of what it did. Agents inside a business suite such as Copilot Studio sit with the rest of that SaaS in A2.

Frameworks: AWS GenAI scope 2AWS agentic scope Prescribed (analyst approves actions) to supervisedOWASP ASI01 Agent Goal Hijack, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities

Last reviewed October 2026. Vendor tiers and features change often. Spot something out of date? Tell us.

FlowsPrompt / responseTool callIdentity / credentialTelemetryUnsafe pathBlocked
BoundariesYour boundaryThird party

How Vendor-Run Agents works

Vendor platformYour systems12345678ACTORAlerts and incidentsEDR, SIEM, pagerRISKAttacker-controlled datalog fields, hostnames, emailMODELVendor's modelsnamed subprocessorsWORKLOADVendor AI agentAI SOC or AI SRESECRETSCredentials at vendorAPI clients, tokens, rolesACTORAnalyst approvalcontain, disable, roll backKEEPCONTROLScoped accessread-only by defaultKEEPCONTROLAccess findingsAccess Analyzer, token zonesSIMPLIFYTOOLSEDR and SIEMCrowdStrike, SentinelOneTOOLSIdentity providerOkta, Entra, GoogleTOOLSCloud accountsAWS, Azure, GCPTELEMETRYYour own logsCloudTrail, Okta, EDR auditKEEP

Data flow

  1. 1An alert, incident or page goes to the vendor's agent, which investigates on its own and writes up a verdict.
  2. 2The agent reads data an attacker can write: log fields, hostnames, email subjects, user agents. 2026 research showed injected log entries suppressing detections in an AI analyst, and the best defense tested cut that rate by about half.
  3. 3Investigation data goes to the vendor's model providers. Check the named subprocessors, no-training terms, retention and region before you connect anything.
  4. 4The vendor stores the keys to your systems: EDR API clients, identity provider tokens, a cloud role. Stolen vendor tokens were the way in for the Salesloft Drift breach in 2025 and the Klue breach in 2026.
  5. 5Grant read-only scopes for investigation, through a dedicated role, service app or API client per vendor. Prefer an AWS role with read-only policies over access keys, and an Okta OAuth service app with one-hour tokens over an API token that inherits an admin's rights.
  6. 6Response actions such as isolating a host, suspending a user or revoking sessions use a separate write integration, with each action turned on one by one and an analyst approving it. Some, like revoking sessions, can't be undone.
  7. 7Every call the agent makes lands in your own logs: CloudTrail, the Okta System Log, the EDR's API audit. Alert on what it does from your side, not only in the vendor's console.
  8. 8AWS IAM Access Analyzer flags roles that outside accounts can assume, and Okta network zones limit where an API token works. Entra Conditional Access for workload identities doesn't cover multitenant vendor apps.

Build or buy

Mostly buy

What you can buy for each box in the diagram, the open source option, and the part you still build yourself.

ComponentBuyOpen sourceYou buildMaturity
Vendor AI agentAI SOC: Dropzone AI, Prophet Security, 7AI, Torq, Microsoft Security Copilot agents, CrowdStrike Charlotte AI. AI SRE: Resolve.ai, Cleric, Datadog Bits AI SRE.·A vendor review: model providers, training terms, retention, region, and what the integration asks for.GA
Scoped accessPer-scope read or write API clients in CrowdStrike, an Okta OAuth service app with granted scopes and an admin role, an AWS IAM role with read-only managed policies and an external ID.·One role or client per vendor and per purpose (investigate vs respond), named so you can find it.GA
Analyst approvalBuilt into some products: Dropzone runs each containment action on an analyst's click, with actions enabled one by one. Entra's Conditional Access Optimization Agent only creates report-only policies until an admin approves.·A list of actions the vendor may take, who approves, and which can't be undone.GA
Credentials at vendorShort-lived options where the vendor supports them: an assumed AWS role instead of access keys, one-hour Okta service app tokens instead of API tokens.·A rotation and revocation runbook per vendor, tested before you need it.GA
Your own logsCloudTrail, the Okta System Log, EDR API audit logs, Entra service principal sign-in logs, into the SIEM you already run.·Detections for each vendor identity: new actions, new source IPs, bulk exports.GA
Access findingsAWS IAM Access Analyzer external access findings, Okta network zones on API tokens, a SaaS security tool for OAuth grants.Steampipe, ProwlerA quarterly review of every vendor role, token and grant, with an owner for each.GA

Rollout steps

#StepWhoEffort
1List every vendor that holds a token, API client or role into your EDR, identity provider, SIEM or cloudSecurity engineer2-3 days
2Replace shared admin tokens with a dedicated read-only role or service app per vendorSecurity + platform engineer1-2 weeks
3Add response actions one at a time, each behind an analyst's approvalSecurity lead1-2 weeks
4Restrict where tokens work (network zones, external ID, IP allowlists) and turn on Access AnalyzerPlatform engineer1 week
5Write detections on each vendor identity in your SIEM and test the revoke runbookDetection engineer1-2 weeks

What you still build

  • An inventory of vendor roles, API clients and tokens, with an owner and scope for each
  • Detections per vendor identity in your own SIEM
  • A revoke and rotate runbook per vendor, rehearsed once
  • An approved-actions list for each AI SOC or SRE agent

Gotchas

  • Integrations often ask for more than they need. One AI SOC data integration requests write scopes on hosts, real time response and IOC management just to investigate.
  • Some products test only the read permissions when you save the integration. Check write access yourself.
  • Okta API tokens take the rights of the admin who created them and stay valid while in use. Prefer an OAuth service app.
  • Entra Conditional Access for workload identities doesn't cover multitenant third-party apps, which is what most vendor agents are.
  • AWS says the external ID should come from the vendor and isn't a secret. It stops the confused deputy problem, not a stolen role.
  • A self-hosted option is not automatically safer: one vendor's in-VPC agent uses static AWS access keys where its SaaS version uses an assumed role.
  • No defense tested in 2026 research fully stopped injected log entries from steering an AI analyst. Keep humans on the actions that matter.

Common use cases

  • Alert triage and investigation
  • Incident response with containment actions
  • On-call root cause in cloud and Kubernetes
  • Agents acting in your identity provider and cloud

Key risks

  • Stolen vendor tokens reach every connected system
  • Write scopes granted for read-only work
  • Attacker-written log data steers the analyst
  • Response actions that can't be undone
  • Investigation data kept by the vendor and its model providers

Fast path

  • KEEPRead-only integration first, write actions added one at a time
  • KEEPA dedicated role, service app or API client per vendor, never an admin's token
  • KEEPAnalyst approval for containment and account actions
  • KEEPYour own logs of every vendor call, not just the vendor's console
  • SIMPLIFYQuarterly review of vendor roles and tokens before an inventory tool

Sources

Vendor documentation and announcements we checked for this page. Products are examples of a category, not endorsements.

Not sure which pieces to buy and which to build?

Bring the AI tools your teams use today and the data they touch. In a 30-minute call we map you to these models and name the controls to add first. No sales pitch.

Talk to a CISO