AWS CISO Amy Herzog’s optimism about AI agents is grounded in a specific benefit: agents can collect and connect security evidence far faster than people working manually. Amazon has reported major internal gains in that kind of information assembly, including a frequently cited “500% increase.” That figure is not an audited measure of breach reduction, analyst productivity across the company, or faster incident response. It is an AWS-reported internal efficiency claim whose methodology has not been publicly disclosed.
The practical lesson is narrower and more useful. Agents can handle repetitive enrichment and first-pass analysis, while people retain responsibility for severity, business impact, remediation and high-risk actions.
As an Amazon Associate I earn from qualifying purchases.
What Amy Herzog actually claimed
In an interview published by ITPro on December 8, 2025, after AWS re:Invent 2025, Herzog said she was optimistic that agentic AI would be a “boon” for cyber professionals. Her argument was not that autonomous systems would replace security specialists. It was that agents could reduce the time spent stitching together information from vulnerability records, cloud systems, tickets, logs and ownership databases.
Recommended Free Tools
That distinction matters. Security automation has three separate layers:
#1 Best Overall
- Evidence gathering: collecting findings, asset details, exposure data and relevant history.
- Recommendations: suggesting severity, likely owners, investigation steps or remediation options.
- Authorization and execution: approving and performing actions such as changing production systems, revoking credentials or isolating a host.
Amazon’s reported use cases focus mainly on the first two layers. Human experts remain accountable for decisions where context, uncertainty and customer impact matter.
Read the ITPro interview with Amy Herzog.
How Amazon was using agents
The reported internal workflows include processing critical-vulnerability updates, enriching alerts and tickets, supporting threat investigations, and preparing material for responders. Agents were also described as helping teams move from an initial signal toward plausible actions, remediation and root-cause analysis.
Application security is another part of AWS’s strategy. AWS describes Security Agent as a tool for on-demand penetration testing, threat modeling, code-security review, vulnerability identification and validation, and remediation guidance throughout the development lifecycle. Those are AWS’s stated capabilities, not independent evidence that the product replaces a professional penetration test or a security-operations platform.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Amazon’s internal responder tooling, Security Agent and the infrastructure product Amazon Bedrock AgentCore are different things. An internal agent is not automatically a customer-facing service, and AgentCore is a building and operating layer rather than a ready-made SOC assistant.
What the “500% increase” means—and does not mean
Herzog said AWS had seen a 500% increase in its ability to “piece together information” for security teams. AWS has not publicly disclosed the baseline, observation period, number of cases or analysts, measurement formula, or whether quality and accuracy changed alongside throughput.
Accordingly, the defensible interpretation is:
Herzog described a 500% increase in the team’s ability to assemble security context, but AWS has not publicly disclosed enough methodology to treat that as a universal productivity benchmark.
It should not be rewritten as a 500% reduction in cyber risk, a fivefold improvement in mean time to respond, or proof that every security team will obtain the same result. The claim is an AWS-reported internal metric from the company’s 2025 disclosure, not an independently audited benchmark as of August 18, 2026.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why vulnerability management is a strong agent use case
CVE analysis combines high volume with data spread across many systems. A useful workflow looks like this:
Rank #3
- A vulnerability disclosure or update arrives.
- The system checks whether affected technologies are present.
- It identifies affected accounts, services, hosts, images, libraries or applications.
- It correlates exposure, exploitability, ownership and existing mitigations.
- It prioritizes cases and drafts the evidence for a ticket or escalation.
- A human validates the mapping and chooses remediation, exception or further investigation.
Agents are well suited to cross-system lookups and summarization. They are less reliable when asset criticality is unclear, telemetry conflicts, compensating controls are undocumented or a patch could interrupt an important business service.
The 11-question problem shows why workflow design matters
A separate example from the ITPro interview prevents the headline from becoming a technology-only story. Users of an internal responder agent reportedly asked about 11 questions per case on average. The agent was useful enough to invite follow-ups, but the conversation itself consumed time that automation was supposed to save.
AWS then tuned the experience toward producing a comparable result in approximately two questions. That is a workflow improvement, not a universal interaction target.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Teams evaluating an agent should measure outcomes such as:
- Time from signal to triage decision.
- Time from triage to approved remediation.
- Analyst interactions per case.
- Recommendation acceptance and material-change rates.
- False-positive and false-negative rates.
- Escalation, rework and analyst-hours saved.
- Mean time to contain and recover.
- Cost per investigated case.
Counting prompts or model calls alone can reward a busy system without proving that security outcomes improved.
AWS’s broader agent strategy
AWS’s approach has several layers that should not be conflated:
| Layer | Purpose | What it is not |
|---|---|---|
| Internal responder agents | Enrich findings, assemble context and support Amazon’s responders. | A generally available turnkey service. |
| AWS Security Agent | Application-security analysis across development workflows. | Independent proof of penetration-testing efficacy. |
| AWS Security Hub | Centralizes findings and security-posture workflows across AWS services. | An endpoint, identity or multicloud platform by itself. |
| Amazon GuardDuty | Continuous AWS threat detection and anomalous-activity monitoring. | An autonomous response agent. |
| Amazon Bedrock AgentCore | Runtime, gateway, identity, memory, observability and tool components for custom agents. | A finished SOC assistant. |
AgentCore is described as consumption based, with no upfront commitment or minimum fee. Its pricing page lists runtime at $0.0895 per vCPU-hour and $0.00945 per GB-hour, gateway API invocations at $0.005 per 1,000 invocations, and web search at $7 per 1,000 queries. These are page-listed signals and may vary by region, taxes, service changes and separate model, logging and security-service charges. See the AgentCore FAQ and pricing page for current terms.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Security Hub Essentials includes a 30-day unlimited free trial; optional plans are outside that trial. GuardDuty offers a 30-day trial for new use in supported Regions. Pricing and regional availability should be checked before a purchase decision.
Best Value
The security controls agents require
An agent that can read telemetry should not automatically be able to alter identity controls, delete evidence or deploy code. Risks include:
- Excessive permissions: broad credentials turn a helpful analyst into a high-impact attack path.
- Prompt injection: malicious text in tickets, repositories, logs or web pages can influence tool use.
- Data leakage: source code, customer information and sensitive telemetry may be sent to models or connectors.
- Incorrect correlation: a plausible but wrong owner or asset mapping can misdirect remediation.
- Automation bias: confident language can cause reviewers to accept an unsafe recommendation.
- Evidence contamination: AI-generated summaries may be mistaken for original records, creating circular reasoning.
- Non-determinism and audit gaps: teams need records of inputs, model and tool versions, permissions, outputs, approvals and final actions.
- Cost and availability risk: repeated tool calls can raise consumption charges, while a model or connector outage can interrupt a security workflow.
Herzog’s later discussion emphasizes that agent identity and authorization should not simply copy human-user governance. An agent’s identity, delegated authority, tool scope and approval path need to be explicit. Herzog’s commentary on agent governance addresses that distinction.
What people should continue to own
- Ambiguous severity and customer-impact decisions.
- Risk acceptance and patch exceptions.
- Production changes, credential rotation and access revocation.
- Isolation or shutdown of business-critical systems.
- Public disclosure and attribution judgments.
- Root-cause conclusions.
- Detection changes that could suppress future alerts.
An agent can prepare evidence and propose actions. It should not receive unrestricted execution authority because it is faster at gathering information.
How to run a responsible pilot
- Choose one bottleneck: CVE triage or alert enrichment is easier to evaluate than “the SOC.”
- Start read-only: connect the agent to approved data sources without change privileges.
- Create a baseline: replay historical cases and record analyst time, accuracy, rework and cost.
- Require evidence links: every conclusion should point to raw findings, configurations, code or event records.
- Add approval gates: keep production changes, isolation and identity actions human-approved.
- Test hostile inputs: include prompt-injection attempts, missing data and contradictory ownership.
- Set budgets and fallbacks: cap tool calls and define a manual process for model or connector failure.
- Expand only after thresholds are met: faster decisions are not enough if false negatives, rework or unsafe actions rise.
Who is most likely to benefit
The strongest fit is a data-rich organization with reliable asset inventory, centralized telemetry, clear ownership and repeatable workflows. Agents can magnify those strengths. They can also automate confusion faster when naming is inconsistent, logging is incomplete or exceptions are undocumented.
Organizations already centered on Microsoft Defender, Sentinel and Entra may compare Microsoft Security Copilot at Microsoft’s product page. Google-centric teams can examine Google Security Operations; endpoint- and XDR-led teams may consider CrowdStrike Falcon or SentinelOne Purple AI. A custom workflow built with AgentCore offers control but leaves the buyer responsible for connectors, policies, testing, monitoring and ongoing cost management.
The Bottom Line
AWS’s evidence supports a measured conclusion: AI agents can make security teams faster at assembling context and handling repetitive investigation work. The “500%” figure is an attributed, insufficiently documented internal metric—not a promise of fivefold security performance. The durable advantage comes when narrow agents operate with clean data, least privilege, human approval and outcome-based measurement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
