Why AI agents break existing SOC assumptions
Traditional identity monitoring assumes a stable set of humans with predictable patterns and a small number of long-lived service accounts with stable behaviour. AI agents violate every assumption: they proliferate, act at superhuman rates, use tools the operator didn't anticipate, and often chain identities in ways that break blast-radius analysis.
An agent orchestrated by an LLM can, in a single session, assume six different IAM roles, read from three databases, call five SaaS APIs, and drop artefacts in an S3 bucket — all in under 30 seconds. Every one of those actions is legitimate individually and suspicious in aggregate. Detecting this requires a per-agent behavioural baseline, not a per-service-account one.
Agent identity: register, tag, baseline
The first requirement is unambiguous agent identity. Every agent should have a dedicated principal (IAM role, service principal, workload identity) that is never shared with a human or another agent. The identity must be tagged with (a) agent purpose, (b) agent owner, (c) autonomy tier, (d) MCP server or framework version.
Once identified, the entity graph tracks agent-specific baselines: hours of activity, target APIs, tool call sequences, error rates, and network egress. Deviations from these baselines are treated with lower tolerance than for humans because the acceptable behaviour space is narrower.
- Each agent has a dedicated, non-shared principal
- Agent principal tags: owner, purpose, autonomy tier, framework version
- MCP server registration includes signed manifest
- Baseline captures: hours, target APIs, tool sequences, egress destinations
MCP server security
MCP (Model Context Protocol) servers are the API surface AI agents call. Every MCP server should be treated as a privileged internal service: TLS-terminated, mutually authenticated, and instrumented with per-call logging. The registered server manifest is the source of truth for which tools an agent can call.
ManySignal ships a native MCP server for security operations — it exposes read-only investigative tools (query graph, fetch case, look up entity) plus a governed set of response tools (isolate host, revoke session) that go through the same autonomy ladder as human-triggered actions.
{
"jsonrpc": "2.0",
"id": "req-482",
"method": "tools/call",
"params": {
"name": "manysignal.graph.query",
"arguments": {
"entityType": "identity",
"entityId": "[email protected]",
"window": "24h",
"include": ["baselines", "recent_events"]
}
}
}Detecting agent abuse
Three detection classes handle the majority of agent-abuse cases: (1) tool sequence anomaly — an agent calling tools in an order it never has before, (2) target expansion — an agent touching entities outside its historical baseline, (3) rate anomaly — an agent spiking above its baseline volume in a short window.
Each of these can fire alone benignly (deploys can look like target expansion; incident response can look like rate spikes). The combination — sequence + expansion + rate together — is a near-certain signal of misuse or compromise.
Response patterns for agent incidents
The right response to agent misuse is usually not "disable the agent" — that breaks a production workflow. Better patterns: (a) revoke the specific tool that's being abused, (b) drop the agent's blast-radius cap so subsequent actions require approval, (c) rate-limit the agent's principal to below its baseline volume, (d) rotate the agent's credentials.
Kill switch is the last resort. A tenant-level kill switch that halts all agentic action mid-flight exists for the case where the specific compromise scope is uncertain. Practice using it in tabletops — muscle memory matters when the real event happens.
Key takeaways
- AI agents violate the human/service-account assumption — treat them as a new principal class with their own baselines.
- Register every agent with a dedicated principal, owner tag, and autonomy tier.
- MCP server manifests are the source of truth for allowed tools.
- Three detection classes cover most abuse: tool sequence anomaly, target expansion, rate spike. Combination is decisive.
- Prompt injection detection is porous; behavioural baselining is not.
- Practice the kill switch in tabletops — muscle memory matters when it counts.