I was at the SANS DFIR Summit last week and spent quality time with my fellow DFIR nerds. A clear pattern emerged from my discussions: security teams are seeing agent-related incidents. The most common situations? Employees misusing agents and attackers compromising employee credentials to AI platforms and using the victim’s agents and access as a pathway to more access and data.
In one talk, Raymond DePalma called out the disarray in agent logging, with many cloud and AI providers disabling it by default. This led to additional conversations with other attendees, and one stuck with me. An analyst shared a story about an employee whose credentials were stolen, and an external threat actor logged in and had a field day with their access. Their investigation objective was to determine what the threat actor accessed.
One problem. They had no visibility into what the agent did, so they took the scenic route. It took weeks to catalog the tools the agent could access and hunt down and analyze the logs from the various SaaS providers (if they even existed) to confirm whether the threat actor used the agent to access data in the associated SaaS tool. When you need answers now, weeks can feel like an eternity!
That theme of no visibility keeps coming up again and again.
Stop looking at the shadows on the wall.
Without clear visibility into agent activity, trying to understand what happened is like watching a shadow puppet show. Security teams are looking at the wall, sitting in front of a puppeteer (the threat actor) casting shadows (the actions), with a light source (where the agent operates) behind them.
Growing up in the DFIR world before EDR, I had to do the same with investigations. I had to look at the projections of attacker activity in other logs to infer how they used a compromised account to move around an entire enterprise. I had to look outward to find the answers I needed. That is, until EDR gave real-time visibility into what attackers were doing. It became a flight recorder of nearly every step an attacker took.
The right visibility changes everything.
Turn around, visibility is right behind you!
Visibility into agent activity must sit as close as possible to where the agent operates. Where do agents operate? Many point to the endpoint. Back in early 2026, you would have been right. But this is AI. Every month is a brand new world. Agents are operating on your endpoint, in frontier lab infrastructure, in your cloud environment, and in SaaS platforms…so…everywhere.
Proper visibility starts with having eyes everywhere an agent operates.
Logging without action is just a tax.
For many organizations, the first step is enabling logging. The agent telemetry stays local to the platform, and teams are stuck using whatever second-hand features the platform provides, if any. In one discussion, a security leader shared that with Microsoft Purview, it would take their team 45 minutes just to find two prompts. Now, take that frustration with a single AI provider and apply it across the multiple AI platforms most organizations use. It’s impossible without the right tooling.
So organizations send agent telemetry to their SIEM to centralize it. To which I always ask: “What are you doing with that logging?” The answer is always the same: “We’re not sure what to do with it yet, but we have it just in case.” Then months go by, and they start to see how much telemetry an agent produces and how expensive it can be to manage that. You’re paying a tax for no intentional gain. Again, not super helpful.
Agent telemetry is high density.
In my discussions at SANS, the teams that got as far as creating detections for agent misuse and rogue agents all reported the same thing: NOISE! And lots of it.
Today’s security tools weren’t built for how agents operate. The risks sink to the bottom of a large ocean of noise in agent telemetry. That’s why Evoke reimagined detection and response for agent activity. Evoke focuses on behavior patterns, not strings, to surface risky activity no one is looking for, even though it happens every day.
The right tooling enables better visibility, control, and response.
The way employees get work done is shifting before our eyes. From pen and paper to computers to SaaS to agents. Every tech evolution has required new ways to see and secure the new layer. And every one has taught security teams the same lesson they’re learning all over again:
Major platforms exist to serve customers using their product, not the security team responsible for preventing and investigating misuse of that product.
The right visibility leads to the right detections. The right detections lead to the right blocking. Everything starts with visibility.
That’s what Evoke was built to do for the emerging agent-dominated world. If you’re wondering how to tackle this, let’s chat.
