Figma Automates Security Investigations with AI Agents

Figma, a major design tool company, has officially documented that its engineering team has developed and operates an AI agent to support its security team. This agent handles a wide range of tasks including investigating security alerts, searching for past incidents (failures and incidents), verifying internal systems, and even creating code fixes. The mechanism involves AI processing a series of tasks that were previously handled manually by people, in a coordinated manner.

One of the challenges security teams face daily is responding to a massive number of alerts. For each alert, the process of investigating past cases, confirming the scope of impact, and determining response measures requires time and specialized knowledge. Particularly when similar alert patterns occur repeatedly, teams must restart the investigation process from scratch each time, placing a heavy burden on engineers. While the industry as a whole is moving toward using AI to reduce such repetitive work, Figma has published specific details of its approach to this effort.

A major feature of the agent Figma developed is its ability to learn from past investigation histories. By referencing how previous investigations of similar alerts were conducted and what conclusions were reached, the system enables subsequent investigations to proceed more quickly. Additionally, the system automatically prepares code fix suggestions when needed, eliminating the effort required for engineers to write solutions from scratch. Through this series of mechanisms, the engineering team reports that resolution time for complex alerts has been reduced by approximately 70%.

This initiative attracts industry attention because it presents an AI agent integrated into "actual business workflows" and is disclosed in relatively detailed form. Rather than being a simple chatbot, "agent-type AI" that combines multiple capabilities such as system access, historical data retrieval, and code generation has rapidly integrated into real-world business operations in recent years. The security domain is one of its early adoption fields, and Figma's case demonstrates one concrete example of this trend.

The 70% reduction in processing time has practical significance for security response operations. In responding to cyberattacks and vulnerabilities, the speed of initial response often determines the scale of damage, and significant reductions in investigation time can directly lead to mitigation of business risk. Conversely, the structure in which AI assists or replaces investigative judgment may raise new questions about how to manage risks such as false positives and oversights. Going forward, how to design precision and safety assurance becomes a focal point in similar initiatives.

Figma's disclosure can serve as a practical reference example for other companies seeking to integrate AI agents into their own security operations. In particular, the design of "learning from past investigations" creates a structure where accuracy improves with time spent, making it noteworthy from the perspective of long-term operational effectiveness. As cases of AI-assisted security response accumulate and potentially develop into industry-standard approaches, it remains valuable to continue tracking these developments.