--- title: How Agentforce-Powered AI Security Workflows Speeds... description: A Salesforce engineering architect describes how Security Center evolved from a conversational AI interface into a stateful, Agentforce-powered investigations... canonical: https://daily.dev/posts/how-agentforce-powered-ai-security-workflows-speeds-incident-response-4ctrz0eto twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Agentforce-Powered AI Security Workflows Speeds Incident Response | daily.dev og:description: A Salesforce engineering architect describes how Security Center evolved from a conversational AI interface into a stateful, Agentforce-powered investigations... og:url: https://daily.dev/posts/how-agentforce-powered-ai-security-workflows-speeds-incident-response-4ctrz0eto og:image: https://api.daily.dev/og/posts/4cTrZ0Eto.png og:image:alt: How Agentforce-Powered AI Security Workflows Speeds Incident Response og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Agentforce-Powered AI Security Workflows Speeds Incident Response **[Salesforce Engineering](https://daily.dev/sources/salesforceeng)** · 6 min read · 2 upvotes · 0 comments ## Summary A Salesforce engineering architect describes how Security Center evolved from a conversational AI interface into a stateful, Agentforce-powered investigations platform for security incident response. The interview covers challenges in validating non-deterministic LLM behavior at scale (solved via AI-driven evaluation pipelines that boosted testing throughput 10-20X), managing finite context windows across large telemetry datasets, mitigating hallucinations in security reasoning, and architecting extensible data models across heterogeneous telemetry systems. It also touches on ongoing work to ground responses in Salesforce-specific security knowledge rather than relying solely on public foundation models. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do you test AI agents that give different responses to the same prompt in security workflows? Non-deterministic LLM behavior is validated using AI-driven evaluation pipelines where large collections of simulated customer interactions are fed into the agent, and LLM evaluators assess whether responses align with the intended investigative outcome rather than checking exact wording. This approach increased testing throughput by roughly 10-20X compared to manual validation, enabling continuous evaluation of new scenarios and prompt variations. _daily.dev surfaces engineering approaches like this for teams building evaluation pipelines for non-deterministic AI systems._ ### How do you keep an AI agent's context accurate when security telemetry from multiple systems exceeds the LLM context window? Telemetry is partitioned into smaller contextual segments and compressed using AI-driven summarization pipelines before being fed into the agent, avoiding passing raw investigation data directly into the model. Extensible investigation data models handle disparate telemetry formats across systems without tightly coupling the architecture to specific threat types, mitigating what the team calls reasoning pocket collapse. _Engineers designing retrieval and summarization pipelines for large-context AI agents can track this pattern on daily.dev._ ## Similar posts on daily.dev - [How Salesforce Security Uses Agentforce to Triage Security Reports](https://daily.dev/posts/how-salesforce-security-uses-agentforce-to-triage-security-reports-a11xdyj2l) · Salesforce Engineering · 0 upvotes · 0 comments - [Understanding Agentforce: The Future of Autonomous CRM Agents](https://daily.dev/posts/understanding-agentforce-the-future-of-autonomous-crm-agents-32xjlby7k) · Medium · 3 upvotes · 0 comments - [How Agentforce Runs Secure AI Agents at 11 Million Calls Per Day](https://daily.dev/posts/how-agentforce-runs-secure-ai-agents-at-11-million-calls-per-day-uhsjtrcrq) · Salesforce Engineering · 9 upvotes · 0 comments - [Salesforce is crowdsourcing its AI roadmap — with customers](https://daily.dev/posts/salesforce-is-crowdsourcing-its-ai-roadmap-with-customers-busiahsw3) · TechCrunch · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/how-agentforce-powered-ai-security-workflows-speeds-incident-response-4ctrz0eto) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Agentforce-Powered AI Security Workflows Speeds Incident Response","url":"https://daily.dev/posts/how-agentforce-powered-ai-security-workflows-speeds-incident-response-4ctrz0eto","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-agentforce-powered-ai-security-workflows-speeds-incident-response-4ctrz0eto"},"datePublished":"2026-08-12T19:34:22.977Z","dateModified":"2026-09-14T07:29:47.999Z","description":"A Salesforce engineering architect describes how Security Center evolved from a conversational AI interface into a stateful, Agentforce-powered investigations...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b7ff590c9cf3d0cdc276915979dc5965?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b7ff590c9cf3d0cdc276915979dc5965?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Salesforce Engineering","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Salesforce Engineering","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/513375817ec24d97b9cdb5efd16f87f2","url":"https://daily.dev/sources/salesforceeng"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-agentforce-powered-ai-security-workflows-speeds-incident-response-4ctrz0eto","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,ai-agents","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Salesforce Engineering","item":"https://daily.dev/sources/salesforceeng"},{"@type":"ListItem","position":3,"name":"How Agentforce-Powered AI Security Workflows Speeds Incident Response"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-agentforce-powered-ai-security-workflows-speeds-incident-response-4ctrz0eto#faq","mainEntity":[{"@type":"Question","name":"How do you test AI agents that give different responses to the same prompt in security workflows?","acceptedAnswer":{"@type":"Answer","text":"Non-deterministic LLM behavior is validated using AI-driven evaluation pipelines where large collections of simulated customer interactions are fed into the agent, and LLM evaluators assess whether responses align with the intended investigative outcome rather than checking exact wording. This approach increased testing throughput by roughly 10-20X compared to manual validation, enabling continuous evaluation of new scenarios and prompt variations. daily.dev surfaces engineering approaches like this for teams building evaluation pipelines for non-deterministic AI systems."}},{"@type":"Question","name":"How do you keep an AI agent's context accurate when security telemetry from multiple systems exceeds the LLM context window?","acceptedAnswer":{"@type":"Answer","text":"Telemetry is partitioned into smaller contextual segments and compressed using AI-driven summarization pipelines before being fed into the agent, avoiding passing raw investigation data directly into the model. Extensible investigation data models handle disparate telemetry formats across systems without tightly coupling the architecture to specific threat types, mitigating what the team calls reasoning pocket collapse. Engineers designing retrieval and summarization pipelines for large-context AI agents can track this pattern on daily.dev."}}]} ```