Figma's Security Agents Cut Complex Alert Resolution Time by 70%

Figma's security engineering team has documented how they replaced manual alert triage with a multi-agent system that cuts resolution time for complex alerts by roughly 70% and reduces on-call pages by 20% — the latter by automatically downgrading alert severity rather than simply suppressing noise. For practitioners building production agentic workflows, the writeup is notable less for its headline numbers than for the specific architectural choices that produced them.

Alert Triage Agent: Scope and Tooling

The triage agent — described as running on a model like Claude Opus — receives the full Slack thread history for a given alert as context, alongside what the team calls "steering memory." Its tool surface is deliberately scoped to the operations a security on-call engineer typically performs: querying audit logs across AWS, Okta, GitHub, GCP, and osquery (the open-source SQL-over-endpoint tool), plus more than 100 additional data sources. The system is built on Panther SIEM and uses AWS Bedrock Knowledge Bases, Amazon Kendra, Tines, and a Snowflake-based tool to search historical alerts and query Panther data directly.

The scope boundary is a deliberate safety decision: rather than giving the agent broad platform access and relying on prompt-level restrictions, Figma embedded constraints in the tools themselves. Agent-created pull requests are set to draft by default, and prompts are designed to block sensitive data from appearing in public Slack channels.

Memory Architecture: Three Distinct Layers

Matthew Sullivan (formerly at Figma, now at Nition) and Brad Girardeau (security engineering manager at Figma) identify memory as the feature with the greatest compounding impact on system utility over time — and flag keeping memory types separate as a non-obvious but critical design choice. The system maintains three distinct stores:

Collapsing these into a single store would degrade retrieval quality for each: behavioral guidance would contaminate schema lookup, and historical cases would pollute steering context. The separation also makes it easier to audit what the agent learned and from where — a material concern when the agent can open PRs.

Vulnerability Detection: Precision Before Recall

In a companion post titled "How Figma stays ahead of vulnerabilities with agents," the team reports that its agents surfaced more than 100 previously unknown vulnerabilities, including two critical flaws that conventional tooling missed. The code-review agent reached 80% precision within one month of deployment. A second-review step improved detection of known bug classes by approximately 30%, and automated coding guidance correlated with roughly a 50% reduction in certain coding errors.

The team's calibration advice cuts against the instinct to maximize coverage first. Sullivan and Girardeau write that the lesson is to improve precision before recall — counterintuitive because historical bug datasets can only measure recall, while precision problems are what engineers encounter in practice and require a different feedback loop entirely. This framing supports the broader argument that infrastructure governance, not better models, unlocks safe agent deployment in high-stakes workflows.

Human Oversight as an Unresolved Variable

Figma is candid that the current system is imperfect, framing the question not as automation versus human judgment but as finding the right balance — one the team explicitly says is still evolving. This is not a minor caveat. Wiz's GhostApproval research demonstrated that six AI coding assistants could be manipulated by malicious repositories while surfacing a harmless-looking approval prompt to human reviewers. OpenAI has separately disclosed findings on sandbox escapes. These are active threat surfaces affecting precisely the class of agent that can open PRs and query production systems.

Figma's architecture answers part of the trust problem through tool-level constraints and draft-PR defaults, but the question of when autonomous agents can safely act without human confirmation remains open. What the writeup delivers is a concrete implementation baseline — specific memory partitioning, a named model class, an enumerated set of data-source integrations, and measurable outcome figures — that practitioners can evaluate and adapt.