Agentic security glossary
Decoding the terms used in AI and security.
7AI Agents
7AI Agents are AI Agents consisting of a cloud-based LLM, a mission, and access to tools to perform its work and draw a conclusion. 7AI agents are experts in their tasks, and trained to deliver security outcomes. Examples of 7AI agents span from mission agents that spawn additional swarming agents based on alerts to single-task agents.
Access Anomaly Agent
Detects deviations in user access patterns
AI Agent
An AI agent is a software program or system designed to autonomously perform tasks by perceiving its environment, analyzing data, and taking actions to achieve specific goals. AI agents operate independently within defined parameters, using machine learning, natural language processing, and other advanced technologies to execute tasks without requiring continuous human intervention.
Agentic Security
A security model that uses autonomous AI agents to handle alert responses and investigations without human intervention.
Alert Time Correlation Agent
Investigates for alerts triggered in proximity to the alert in question
Anomaly Behavior Agent
Flags unexpected patterns in device activity
Application Security Agent
Scans for vulnerabilities in internally developed software or APIs
Attack Surface Mapping Agent
Identifies exposed services, devices, and domains within the organization’s attack surface
Automated Payload Delivery Agent
Simulates delivering malicious payloads through email, USB drives, or download links
Autonomous Agent
A self-governing software program capable of making decisions and performing tasks without direct human oversight
Behavioral Drift Agent
Tracks long-term shifts in user behavior
Behavioral Signature Learning Agent
Builds new behavioral signatures for entities based on actions
Breach Containment Agent
Automates network isolation of compromised systems
BYOD Policy Compliance Agent
Ensures BYOD usage aligns with security policies
CDN Behavior Analysis Agent
Monitors and investigates traffic patterns related to CDNs
Cloud Shared Responsibility Model
A security framework in cloud environments where the cloud provider manages infrastructure security, while the customer is responsible for securing data and applications
Cloud Security
A set of practices and tools designed to protect data, applications, and infrastructure in cloud environments.
Cloud Vulnerability Agent
Focuses on vulnerabilities specific to cloud environments like misconfigurations or excessive permissions
Command and Control (C&C) Simulation Agent
Creates mock Command & Control infrastructure to test detection capabilities
Common Vulnerabilities and Exposures (CVE)
A standardized identifier for known cybersecurity vulnerabilities
Configuration Drift Detection Agent
Identifies deviations from secure baseline configurations
Connector
Connectors are API integrations with a customer’s IT and security tools allowing 7AI agents to access, query, and enhance their understanding of an alert, its conditions, and form a conclusion.
Container Vulnerability Agent
Analyzes Docker and Kubernetes containers for known vulnerabilities
Credential Sharing Detection Agent
Flags potential credential sharing scenarios
Credential Spraying Agent
Tests brute-force attacks by simulating password spraying across multiple accounts
Data Anomaly Agent
Identifies inconsistencies or unexpected patterns in datasets
Data Correlation Agent
Connects related data points across multiple sources
Database Vulnerability Agent
Detects risks like unpatched database engines or weak authentication settings
Device Behavior Agent
Identify process execution and network, file, registry, and user logon activity
Device Connections Agent
Identifies devices that have connected to a domain
Device Firmware Vulnerability Agent
Monitors firmware versions on devices for vulnerabilities
Dark Web Monitoring Agent
Tracks chatter or leaked credentials on dark web forums
Data Exfiltration Simulation Agent
Mimics data extraction through unauthorized channels like DNS tunneling or HTTP
Device Exposure Agent
Fetches or identifies the exposure level
Device Usage Activity Agent
Gathers a summary of a devices’ recent activity, to provide context
Data Integrity Verification Agent
Ensures data remains unaltered during storage or transit
Data Retention Compliance Agent
Monitors data storage to ensure retention policies are followed
DNS Tunneling Detection Agent
Identifies suspicious DNS tunneling activity
Domain Reputation Agent
Evaluates a domain’s reputation by checking certificates, registration age, and more
Domain Resolution Agent
Resolves the domain name to an IP address to further investigate
Endpoint Exploitation Agent
Simulates endpoint attacks, such as malware delivery or exploitation of local vulnerabilities
Exploit Availability Monitoring Agent
Checks public exploit databases to track weaponized vulnerabilities
Exploit Simulation Agent
Executes known exploits on test systems to evaluate their exposure to vulnerabilities
Exposure Validation Agent
Validates if discovered vulnerabilities are truly exploitable in the environment
Extended Detection and Response (XDR)
A unified cybersecurity solution that consolidates data from multiple sources—such as endpoints, networks, and emails—to improve threat detection and response capabilities
Email Analysis Agent
Analyzes an email’s body, subject, headers, and sender
Email Content Sentiment Agent
Analyzes sentiment within emails for potential insider threats
Email Domain Traffic Agent
Investigates email correspondence between known domains, and examines inbound and outbound email traffic
Email Spoofing Agent
Analyzes email headers (SPF, DKIM, and DMARC) to assess email legitimacy
Email Thread Reconstruction Agent
Rebuilds entire threads to map communication flows
Encryption Compliance Agent
Flags emails sent without required encryption
Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) is a cybersecurity solution that continuously monitors and collects data from endpoints (such as computers and servers) to detect, investigate, and respond to potential security threats in real time.
Enterprise Insights
Enterprise Insights include contextual information about an organization learned by 7AI agents through connecting with internal sources like CMDBs or policies as well as admin-reported context in normal laguage. This contextual information allows 7AI agents to understand nuanced conditions that apply to an individual customer’s environment, and is what allows 7AI to know your environment.
External IP Reputation Agent
Investigates the reputation of an external IP address
File Attachment Agent
Evaluates the file attachments included in an email
File Access Pattern Agent
Tracks access patterns to detect unusual or bulk access
File Obfuscation Detection Agent
Flags files attempting to evade detection through obfuscation
File Reputation Agent
Determines if files are malicious, suspicious, benign, or unknown
File Sharing Policy Agent
Monitors adherence to file sharing policies within the organization
File Size Anomaly Agent
Flags files that deviate significantly from normal sizes
File Type Mismatch Agent
Identifies files where the type doesn’t match the extension or content
Firmware Versioning Agent
Tracks firmware updates and vulnerabilities
Foundation Model
A large-scale machine learning model trained on massive datasets that can be fine-tuned for various specific tasks, such as natural language processing or image recognition
Generative AI (GenAI)
A type of AI that creates new content, such as text, images, or code, based on patterns in the data it was trained on
Group Membership Agent
Tracks and reports changes in group membership for users
Hash Investigation Agent
Investigates file hashes (MD5, SHA1, and SHA256)
HIPAA Data Access Agent
Tracks access to sensitive healthcare data to prevent breaches
Hostname-to-Device Agent
Fetches the unique device ID using only the hostname
Identity and Access Management (IAM)
A framework of tools and policies to ensure the right individuals have appropriate access to organizational resources
Incident Response
A structured approach to managing and resolving security breaches or attacks
Identity and Access Management (IAM)
A framework of policies and technologies that ensure the right individuals have access to the appropriate resources at the right times
Incident Context Compilation Agent
Gathers data around an incident for investigators
Incident Root Cause Agent
Identifies the root cause of a security incident
IoT Device Activity Agent
Monitors behavior specific to IoT devices
IT Asset Tracking Agent
Monitors inventory and usage of IT assets
IP Services Agent
Identifies public services at the domain’s IP and categorizes them
Large Dataset Summarization Agent
Extracts key insights from massive datasets
Lateral Movement Simulation Agent
Mimics lateral movement across devices to test internal defenses
License Compliance Agent
Ensures all software is properly licensed
Machine Learning Drift Agent
Monitors changes in the performance of deployed ML models
Malware Variant Correlation Agent
Maps connections between malware variants and campaigns
Managed Detection and Response (MDR)
A cybersecurity service that combines technology and human expertise to detect and respond to threats
Managed Security Service Provider (MSSP)
A third-party company that provides outsourced security services, such as monitoring, management, and incident response
Metadata Analysis Agent
Extracts and investigates metadata for anomalies
Mitigation Strategy Agent
Suggests tailored responses to specific types of attacks
Multi-Factor Authentication (MFA)
A security measure requiring two or more forms of verification to access an account or system
Natural Language Processing (NLP)
A branch of AI focused on enabling machines to understand, interpret, and generate human language
Network Protocol Misuse Agent
Detects anomalous usage of standard network protocols
Network Vulnerability Scanner Agent
Scans networks for weaknesses like misconfigured devices or outdated protocols
Non-Human Identity
Digital identities assigned to machines, applications, or services to manage their access and interactions within a system securely
Non-Human Work
Repetitive tasks that do not require human creativity or strategic thought, ideal for automation by AI agents
Open Source Vulnerability Agent
Tracks vulnerabilities in open-source components used by the organization
Outbound Spam Detection Agent
Identifies if internal users are sending spam externally
Outcome-Driven Security
A philosophy focused on achieving specific, measurable security results rather than merely deploying tools or features
Outlier Detection Agent
Flags individuals or devices behaving outside typical norms
Ownership Transfer Agent
Logs and verifies changes in ownership for devices
Patch Compliance Agent
Tracks and ensures that critical patches are applied across all systems
Patch Management Agent
Tracks and applies necessary software updates
PCI DSS Payment Data Agent
Tracks storage and usage of payment data per PCI DSS standards
Pen Testing Coordination Agent
Integrates findings from manual pen testing with automated vulnerability scans
Phishing Org Context Agent
Investigates the identity and role of an email recipient, gathers if links were clicked, or attachments downloaded
Phishing Simulation
A training exercise that mimics real-world phishing attempts to educate users on recognizing and avoiding them
Phishing Simulation Agent
Creates realistic phishing email campaigns to test employee susceptibility
Playbook Execution Agent
Automatically carries out predefined incident response playbooks
Policy Violation Detection Agent
Flags violations of internal security or operational policies
Port Scanning Detection Agent
Flags potential scanning attempts on internal/external networks
Port Scanning Agent
Simulates malicious port scans to identify open and vulnerable ports
Post-Incident Forensic Agent
Collects evidence for detailed post-incident analysis
Post-login Activity Agent
Checks for unusual activity associated with a device post-login
Post-login User Activity Agent
Investigates unusual activity associated with the user post login
Privilege Escalation Agent
Monitors and investigates unauthorized privilege escalations
Privilege Escalation Simulation Agent
Tests potential privilege escalation paths within systems
Privileged Access Management (PAM)
A security strategy focused on monitoring and controlling access to critical systems by privileged users
Process Communication Agent
Investigates internal processes linked to network traffic with an external IP
Reinforcement Learning (RL)
A machine learning technique where agents learn to make decisions by receiving rewards or penalties for their actions in a simulated environment.
Remediation Tracker Agent
Tracks progress on remediating vulnerabilities and highlights overdue actions
Retrieval-Augmented Generation (RAG)
A method of combining AI-generated responses with retrieved, contextually relevant data to improve accuracy and relevance
Risk-Based Prioritization Agent
Prioritizes vulnerabilities based on severity, exploitability, and potential impact
Root Domain Agent
Extracts the Top Level Domain+1 from a URL to identify the root domain
SHA1 Alert Evidence Agent
Investigates alert evidence for a file using its SHA1 hash
Service as Software
A cybersecurity approach that uses AI agents to deliver specific security outcomes, integrating seamlessly with existing tools and workflows
Security Information and Event Management (SIEM)
A solution that aggregates and analyzes security data from across an organization to identify and respond to potential threats
Security Orchestration, Automation, and Response (SOAR)
A platform that integrates tools and processes to automate security workflows, enabling faster response to incidents
Service Uptime Monitoring Agent
Ensures critical services remain operational
Single Sign-On (SSO)
A user authentication service that allows a single set of credentials to access multiple applications
SOX Compliance Monitoring Agent
Ensures proper financial controls for Sarbanes-Oxley compliances
Social Engineering Test Agent
Simulates social engineering attacks, such as impersonating employees or third-party vendors
Swarm
Swarms are 7AI’s term for use cases that combine a security outcome, a collection of individual AI agents, and the tools they access to perform an investigation, form a conclusion, and output the result.
Swarm Intelligence
A decentralized, collective behavior of AI systems working together to solve complex problems
System Configuration Drift Agent
Detects and reports on unauthorized changes to configurations
Temporal Pattern Analysis Agent
Detects time-based anomalies (example: late-night logins)
Third-party Dependency Agent
Monitors vulnerabilities in third-party services or libraries
Threat Actor Profiling Agent
Builds profiles on known threat actors based on observed activity
Threat Exposure Management (TEM)
The process of identifying, prioritizing, and mitigating vulnerabilities to minimize an organization’s exposure to potential cyber threats
Threat Feed Aggregation Agent
Consolidates intelligence feeds to provide actionable insights
Threat Hunting
Threat hunting is the proactive process of searching for hidden cyber threats within an organization’s systems, using analysis and intelligence to identify and mitigate potential attacks before they cause harm.
Threat Intelligence
Threat Intelligence (TI) is the collection, analysis, and dissemination of information about potential or current cyber threats, enabling organizations to understand adversaries, anticipate attacks, and strengthen their defenses.
URL Agent
Determines whether URLs pose a threat to user accounts or data
User Activity Agent
Confirms with a user, via connectors, about their login activity relative to an alert
User Email Context Agent
Analyzes email activity and metadata to provide context around a user’s communications
User Login Pattern Agent
Reviews the login patterns of the user to identify suspicious activity
User Role Agent
Determines the role and context of a user within an organization
Vulnerability Discovery Agent
Scans systems for known vulnerabilities using public databases like CVE
Vulnerability Scanning
An automated process for identifying security weaknesses in a system or network
VPN Utilization Agent
Tracks and reports VPN usage patterns for security compliance
Web App Attack Agent
Simulates OWASP Top 10 attacks (such as SQL injection, XSS) on web apps
Wireless Network Attack Agent
Tests wireless network security with attacks like deauthentication or packet sniffing
Workflow Optimization Agent
Identifies bottlenecks and suggests process improvements
Workforce Productivity Analysis Agent
Tracks trends in workforce activity levels
Zero-Day Detection Agent
Monitors for patterns indicative of zero-day exploit attempts
Zero-Day Exploit
A cyberattack that targets a previously unknown vulnerability in software or hardware
Zero Trust Architecture
A security model that assumes no user, device, or application should be trusted by default, enforcing strict access controls