Page 52 - Cyber Defense eMagazine September 2025

Adapting Incident Response to Autonomous Agents:

Evolving Practices for the Future of Cyber Defense

By Tannu Jiwnani, Principal Security Engineer, Microsoft

Introduction

Incident response (IR) is a critical function in cybersecurity, tasked with detecting, managing, and
mitigating the impact of security incidents. Traditionally, IR relies heavily on human decision-making, with
security analysts investigating alerts, identifying threats, and taking appropriate action. However, as the
volume and complexity of cyber threats continue to grow, traditional methods can be slow, error-prone,
and insufficient to cope with the increasing pace of attacks.

Autonomous agents AI-powered systems capable of independently detecting, analyzing, and responding
to security incidents are rapidly transforming the landscape of incident response. These agents can
automate repetitive tasks, enhance threat detection, and execute responses in real time, significantly
improving the efficiency and effectiveness of IR. However, the introduction of autonomous agents also
necessitates changes in how IR teams operate, collaborate, and make decisions.

This article explores the evolving role of autonomous agents in incident response and outlines how
incident response practices should adapt to leverage these new technologies while maintaining human
oversight.

Cyber Defense eMagazine – September 2025 Edition 52
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.