Figma's security engineering team built an AI-powered agentic system to handle internal security alert triage, reducing time-to-resolution by 71% and on-call pages by 20%. The system layers a RAG-based alert memory (using AWS Bedrock and Amazon Kendra) with an agentic investigation layer (via Tines and Claude models) that can query a Snowflake security data lake, look up Okta/Wiz/Santa data, and automatically open PRs to fix false positives. Key design decisions include separating memory into case memory (historical alerts), steering memory (behavioral rules), and procedural memory (self-built schema knowledge), plus deterministic guardrails like auto-drafting all agent-created PRs. The agent now handles all initial security response, shifting on-call engineers from investigation to review and judgment.
