Autonomous Security Investigation Agent at Scale

wiz · Tech · 2026 · source Agentic: yes · promotional bias: med · summary-only (no fetched source) · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Cloud security threat investigation

Wiz needed AutoAgent to investigate cloud security events at massive scale, deciding whether events were malicious or false positives despite unpredictable investigation paths and huge context payloads.

Constraints:

• the source transcript was unavailable, so this extraction is summary-only
• AutoAgent handles over 3,000 investigations per day
• each tool call can return gigabytes of cloud-environment data
• different cloud security domains need specialized expertise
• production improvement requires evaluation, simulation, profiling, and multi-team ownership

Architecture

AutoAgent is described as a production-scale autonomous security investigation system. A main investigator agent delegates to specialized sub-agents for domain-specific analysis, uses reflection loops to stop and plan after iterations, stores compressed findings in external agent state, loads threat-specific playbooks from a knowledge base, and improves through weekly evaluation against ground truth, profile-based performance tracking, simulation, LLM-as-judge gap analysis, and team-owned improvement workflows.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  security-event[Security event] --> main-investigator-agent[Main investigator agent]
  main-investigator-agent --> specialized-sub-agents[Specialized sub-agents]
  main-investigator-agent --> playbook-knowledge-base[Playbook knowledge base]
  main-investigator-agent --> tool-ecosystem[Tool ecosystem]
  specialized-sub-agents --> tool-ecosystem
  tool-ecosystem --> agent-state[Agent state]
  agent-state --> main-investigator-agent
  main-investigator-agent --> evaluation-framework[Evaluation framework]
  evaluation-framework --> profile-tracking[Profile tracking]
  evaluation-framework --> simulation-engine[Simulation engine]
  evaluation-framework --> llm-judge-gap-analysis[LLM judge gap analysis]
  llm-judge-gap-analysis --> improvement-teams[Improvement teams]

Components

Data flow

A cloud security event starts an investigation. AutoAgent loads a relevant playbook, gathers tool results, reflects at iteration boundaries, and stores key findings in external state instead of keeping raw context. When specialized expertise is needed, the main agent delegates to sub-agents that return essential findings. Completed investigations feed evaluation, profiling, simulation, gap analysis, and distributed team improvement loops.

Why this architecture

Wiz treats the agent like an operating system because cloud security investigation has unpredictable paths, huge context, many tools, specialized domains, and continuous improvement needs. Sub-agents isolate domain context, reflection prevents generic wandering, external state compresses context, playbooks guide expertise, and evaluation/profiling/simulation turn production investigations into a systematic improvement loop.

Models used: AutoAgent · specialized sub-agents · LLM-as-judge

Scale

• AutoAgent conducts over 3,000 threat investigations daily.
  “Wiz developed AutoAgent, an autonomous security investigation agent that operates at significant scale in production, conducting over 3,000 threat investigations daily.”summary, stated
• Tool calls can return gigabytes of information.
  “First is context explosion - cloud environments are massive, and each tool call can return gigabytes of information.”summary, stated
• Profile features include tool-call ranges like 0-10, 10-20, or 20+.
  “one feature might be total tool calls (categorized as high, medium, or low based on ranges like 0-10, 10-20, or 20+)”summary, stated
• The system runs thousands of real customer investigations for profile construction.
  “They created features from thousands of real customer investigations with actual feedback, generating characteristics that when combined create distinct profiles.”summary, stated

Alternatives considered (roads not taken)

Single monolithic investigation context

Rejected because: Different security domains need specialized expertise and raw context can explode.

Let the agent accumulate all conversation context

Rejected because: The active context window would become unbounded and unmanageable.

Unguided generic investigation

Rejected because: Generic agents struggle to know where to begin and can wander when faced with massive information.

Central data science team owns all improvements

Rejected because: The team became a bottleneck as many organizational teams needed to improve different agent behaviors.

Patterns

multi-agent-orchestration (security)

The main investigator delegates specialized cloud-security areas to sub-agents with isolated context.

context-compaction (memory)

The agent extracts key findings into external state and discards raw conversational context to keep the active window bounded.

agent-memory (memory)

Agent state stores key findings and investigation steps outside the conversation.

prompt-chaining (reasoning)

Reflection checkpoints force the agent to summarize, evaluate scope, and plan next steps before continuing or terminating.

llm-as-judge (evaluation)

Separate LLM judge analysis labels failure modes and aggregates profile-level gap summaries.

eval-driven-development (operations)

Weekly evaluation, ground truth comparison, profiles, simulation, and validated updates drive continuous improvement.

human-in-the-loop-gate (governance)

Human analysts and specialized teams investigate gaps, determine root causes, and publish validated changes.

Tradeoffs

Use specialized sub-agents for deep domains

Chose hierarchical delegation with isolated context over main agent directly handling every specialized security detail.

Rationale: The main agent avoids being overwhelmed while still getting domain-specific findings.

Compress context aggressively

Chose external state with early offloading over retaining the full investigation transcript in context.

Rationale: Massive cloud data makes bounded active context necessary for scale.

Use simulation to validate improvement ideas

Chose replay selected investigation steps with modified parameters over rerunning entire investigations for every prompt or logic change.

Rationale: Simulation reduces cost and speeds iteration where the relevant step can be replayed against known ground truth.

Gotchas (what bit them)

Security investigation paths are unpredictable.

Root cause: Investigators know the starting event but not what later steps will reveal or whether lateral movement exists.

Resolution: AutoAgent uses reflection, playbooks, and flexible tool/sub-agent orchestration rather than a fixed workflow.

Context explosion is the central bottleneck.

Root cause: Cloud environments are massive and tool calls can return gigabytes of data.

Resolution: The system offloads key findings early into external state and discards raw conversational context.

Agents can make generic decisions or repeat themselves.

Root cause: Without deliberate reflection, unconstrained agent loops take predictable actions and wander.

Resolution: Reflection checkpoints force the agent to stop, summarize, evaluate, and plan.

Centralized agent improvement became an organizational bottleneck.

Root cause: Many teams needed different improvements to the same production agent.

Resolution: Wiz built an agent democratization framework so teams can define populations, test changes in simulation, and publish validated improvements.

Evaluation

Wiz evaluates AutoAgent through weekly sampled investigations, ground-truth comparisons, completeness/correctness profiles, simulation, LLM-as-judge gap analysis, and production monitoring of false positives and profile performance.

Metrics: over 3,000 investigations per day · profile features such as 0-10, 10-20, and 20+ tool-call ranges · completeness vs correctness graphs by profile · simulation across large samples of investigations · false-positive calibration improvements validated across profiles

Outcomes

• AutoAgent runs thousands of daily security investigations.
• Reflection, playbooks, sub-agents, and state compression support unpredictable cloud investigations.
• Profile-based evaluation exposed false-positive behavior and guided calibration.
• Simulation and democratized improvement let teams improve agent behavior without central data-science bottlenecks.

Summary-only: the stored summary reports over 3,000 investigations per day but does not provide raw transcript evidence or exact production false-positive rates.