Science & Tech · Cybersecurity · 2 hrs ago
AI agent changed severity ratings for 75.1% of cloud security findings
Sola Security researchers tested an AI agent that checks cloud security findings against the environments where they occur.
They applied it to 9,967 high-severity findings from two commercial platforms across eight production environments.
The agent changed the severity of 75.1% of the findings, lowering 58.5% and raising 16.6%.
Cloud security platforms often assign a fixed severity based on the rule that identifies a problem, but the actual risk can depend on the resource’s surroundings, such as whether it is connected to anything or reachable from the internet.
The agent used evidence about configurations, connected resources and other security products; researchers said nearly half of its decisions relied on evidence beyond the flagged resource.
In read-only checks of eight AWS accounts, the live environment matched the agent’s facts 99.4% of the time for verdicts the checks could settle.
An AI agent changed the severity grade of 75.1% of 9,967 high-severity cloud security findings across eight production environments.
The agent downgraded 58.5% of findings and upgraded 16.6%.
Researchers from Sola Security built the agent to assess findings using evidence about the environments where they occurred.
The agent’s verdicts matched facts checked directly against live cloud infrastructure 99.4% of the time for cases the probes could settle.
The researchers said static rule-based severity ratings can miss environmental context that affects risk.
- Who
- Sola Security researchers Leon Goldberg and Gal Engelberg built the AI agent.
- What
- The agent changed the severity grade of 75.1% of 9,967 high-severity cloud security findings.
- When
- Help Net Security published the report on October 13, 2026. The date of the tests is not stated.
- Where
- The tests covered eight production environments and eight AWS accounts.
- Why
- The researchers tested whether checking findings against their environments could provide more accurate severity ratings.
This story does not have two clearly opposing sides.
The researchers ran the agent on 9,967 HIGH findings from two commercial platforms in eight production environments.
The researchers ran read-only probes on eight AWS accounts to check the facts behind the agent’s verdicts.
- Findings tested
- 9,967 HIGH findings
- Severity changed
- 75.1% of findings
- Downgraded
- 58.5% of findings
- Upgraded
- 16.6% of findings
- Production environments
- 8
- Probe agreement
- 99.4% for verdicts the probes could settle
What people are saying
The rule-severity gap is large in production, and closing it requires evidence from the whole environment.
A static severity reflects the risk of the condition in general,
a queue ordered by it is ordered by the general case.
Sources
Related news
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Amadeus booking-system flaw exposed airline passenger data
Cyberattack affects 80 stores of French supermarket chain Co-operative U
Canadian cybersecurity executive arrested on federal extortion charges
AI safety can draw on cybersecurity collaboration, technology veteran says
DNSSEC key change disrupts some healthcare connections to Germany’s TI
Zscaler adds Claude Mythos 5.1
Attackers target critical SonicWall SMA 1000 flaw days after disclosure
Frontier AI models completed all eight industrial-control attack tests
Cyberattack disrupts cooling systems at hundreds of French supermarkets
Cybersecurity job openings span roles in several countries
