Figma's security engineering team says its agent system cut alert time-to-resolution by 71%. The post later cites around 70% reduction in time-to-resolution on complex alerts, a 20% reduction in on-call pages through AI-driven severity downgrading, and 25% fewer endpoint software approval requests. The system handles all initial security response work for the team, and the post says the on-call engineer's job shifted from "investigate from scratch" to "review what the agent found, confirm or correct, and handle the cases that need human judgment."
The team's SIEM, Panther, runs checks across cloud infrastructure, endpoints, SaaS apps and identity systems, posts alerts into Slack and creates an Asana ticket for on-call engineers. Being on call involved a massive amount of manual work, and gathering context was the main challenge.
The team started with a narrow goal of a retrieval layer that surfaces prior on-call reasoning when a new alert fires. It was built on AWS Bedrock Knowledge Bases and Amazon Kendra: a Lambda handler converts each Panther alert into a standardized document indexed in Kendra, results are biased toward recent alerts and those with investigation context, and engineers' Slack notes are indexed back automatically. When similar alerts were highly likely to be benign or duplicative, severity was downgraded automatically, which produced a 20% drop in on-call pages from that change alone.
An agentic layer was then added using Tines. A webhook fires when the bot is tagged, and a lightweight model (like Claude Sonnet) classifies the request and routes it to a specialized agent with its own scoped tools. The alert triage agent, using a model like Claude Opus, has tools for Okta, North Pole Security Workshop (Santa), Wiz, Slack, Panther and code modification, plus an investigation sub-agent that translates natural-language queries into Snowflake SQL over Panther's data warehouse, which holds AWS CloudTrail, Okta, GitHub, GCP and osquery logs, Workshop/Santa events, Wiz findings and about a hundred other tables.
Memory is kept in separate layers: the RAG corpus as case memory, a markdown steering document the agent can update when an engineer corrects it, and procedural memory in which the sub-agent saves schema notes. After saving a memory, a Zoom question that first needed multiple discovery queries cost a single query. The agent opens PRs against the Panther detections repo or the monorepo, and every PR is set to draft as a deterministic post-step in the Tines workflow because "relying on the LLM to remember 'always create as draft' wasn't reliable enough."
Looking ahead, the team expects a larger share of alerts to be handled automatically, but only behind tighter guardrails. It wants sharper distinctions between memory layers, better ways to decide when an alert is safe to auto-close versus escalate, and its most trusted workflows moved into deterministic, inspectable automation.