Cyberhaven’s Office of the CISO: Embracing Autonomous Security Agents

The Office of the Chief Information Security Officer (CISO) at Cyberhaven is revolutionizing cybersecurity by adopting a new approach: autonomous, agent-driven security. Recognizing the growing disparity between engineering speed and security capabilities, the team made a strategic shift from traditional, human-centric processes to a model where specialized AI agents serve as force multipliers. This transition aims to enhance efficiency and embed security seamlessly throughout the development lifecycle.

The Challenge of the 200:1 Reality

Security teams in modern enterprises are grappling with an overwhelming influx of security alerts, vulnerabilities, and infrastructure changes that require attention. With the rapid acceleration of software development, the gap between developers and security professionals has widened significantly, reaching a staggering 200:1 ratio of engineers to application security experts. Traditional security workflows follow a linear path of identifying vulnerabilities, triaging them, notifying developers, and deploying fixes, consuming a significant portion of security engineers’ time.

At Cyberhaven, a paradigm shift was necessary to scale security operations effectively. Moving away from being a bottleneck, the team transitioned to an orchestrator role, leveraging Autonomous Security Agents. These agents are not mere chatbots but sophisticated digital collaborators that reason, collaborate, and execute complex security tasks.

Cerberus: The Vulnerability Intelligence Ensemble

Lead by David Phillips, Cerberus is a multi-model ensemble system designed to automate the entire vulnerability triaging pipeline. It fetches findings from various sources, conducts reachability analysis by examining the codebase, and facilitates cross-examination between different models to verify exploitable findings specific to Cyberhaven’s environment.

The implementation of Cerberus is based on the principle of Adversarial Collaboration, utilizing multiple models to achieve more accurate results. The process involves ingestion and deduplication of findings, contextual analysis, ensemble runs with specialized agents, cross-examination, and final judgment issuance by a high-reasoning model.

Technical Deep Dive & Architecture of Cerberus

Cerberus’ architecture involves a sophisticated pipeline of processes, including ingestion, context analysis, ensemble runs, cross-examination, and judgment issuance. By utilizing a multi-vendor stack, Cyberhaven successfully mitigates model-specific inaccuracies, reducing false positives by 85% compared to raw scanner outputs.

The Path Towards Autonomous Security

The journey towards autonomous security at Cyberhaven extends beyond Cerberus. The team has also developed Vektr, an agent focused on threat modeling and architectural reviews at scale. This agent integrates seamlessly into the Request for Comments (RFC) process, automatically analyzing architectural documents, applying the STRIDE methodology, and delivering detailed security reviews to architects promptly.

Implementation of Vektr

Vektr’s implementation involves a divide-and-conquer pipeline strategy, wherein specialized sub-agents perform asset discovery, data analysis, threat assessment, and synthesis following the STRIDE framework. By enforcing methodology and utilizing retrieval-augmented generation techniques, Vektr ensures comprehensive threat modeling for architectural designs.

Empowering IT Support with Jarvis

Lead by Brock Talbott, Jarvis is a Slack-native agent dedicated to handling IT helpdesk inquiries, security queries, and taking direct actions in third-party systems. This action-oriented agent automates access requests, analyzes phishing screenshots, provides policy information, and creates tickets for unresolved issues, ensuring round-the-clock IT support for Cyberhaven employees.

Technical Insights & Architecture of Jarvis

Jarvis leverages the Slack Bolt Framework for seamless integration with Slack channels, enabling interactive responses and direct actions in third-party systems. Through integrations with Okta for access requests and vision-based phishing analysis using Claude, Jarvis enhances IT support efficiency and effectiveness.

Driving Collaboration and Innovation

The Cyberhaven security team’s approach to autonomous security extends beyond internal projects. By tracking significant ROI across initiatives such as Arithmos, Threat Modeling, and CyberBot, the team aims to lead the conversation on collaborative security practices. Embracing ensemble agents and addressing trust boundaries in autonomous workflows are key focus areas for Cyberhaven.

Meet the Cyberhaven Security Team

The core team members driving Cyberhaven’s autonomous security initiatives include Aman Sirohi, Chief Security Officer; David Phillips, IT Security Lead; Grant Sowards, Sr. Security Engineer; and Brock Talbott, IT Security Analyst. Each member brings a wealth of experience and expertise in cybersecurity, IT security, and application security, contributing to the success of Cyberhaven’s innovative security projects.

Building a Secure and Autonomous Future

As Cyberhaven continues to pioneer autonomous security solutions, the team invites collaboration and shared knowledge within the cybersecurity community. By advancing towards a more secure and autonomous future, Cyberhaven aims to empower organizations to navigate today’s cyber threats with agility and resilience.