Autonomous Endpoint Isolation
The security agent can recommend containment. It should not necessarily decide whether its own disruptive action is permitted.
The situation
A security agent may detect suspicious activity and recommend isolating an endpoint. Isolation can stop an attack — it can also interrupt a critical business service.
The agent may have strong evidence of malicious activity, but the action itself has consequences. Before execution, the enterprise may need to weigh device criticality, user identity, network dependencies, threat evidence, current incident state and containment policy.
How AnantVerify evaluates it
The security agent remains responsible for proposing the action. AnantVerify independently determines whether the proposed action satisfies the enterprise's assurance requirements. DTT can test:
- Would the decision remain the same if the affected endpoint were a critical production server rather than a user workstation?
- Should an irrelevant hostname change alter the decision?
- What if threat confidence increases while business criticality also increases?
- What if the same action creates a significant downstream blast radius?
Runtime control
The security agent can recommend containment. It should not necessarily decide whether its own disruptive action is permitted.