AI-Powered Tools Reduce High-Severity Cloud Security Risks

Post Views: 1

Cloud security platforms generate findings for each failed rule, creating queues sorted by severity.

Study on AI Agent’s Impact on Cloud Security Findings

A study by Sola Security examined how cloud security priorities shift when an AI system evaluates findings against their specific environments. Researchers Leon Goldberg and Gal Engelberg developed an AI agent to reassess findings from commercial cloud security tools. Testing on 9,967 high-severity findings across eight production environments revealed that 75.1% of the findings had their severity levels altered. Of these, 58.5% were downgraded, while 16.6% were upgraded.

Methodology and Testing

The severity assigned to a finding is determined by the rule that triggered it. Analysis of 599 vendor rules showed that each issued a single severity rating across 99,073 failing findings, regardless of the resource or environment. This static approach reflects generalized risk rather than context-specific factors.

Static Rule Severity Assignments

Researchers noted that rules lack dynamic environmental context, such as whether a flagged resource is connected to other assets or if workloads are active. To address this, the AI agent evaluates findings by simulating potential attacker exploitation paths. It gathers evidence from the resource’s configuration, connected assets, and data from other security tools.

AI Agent’s Evaluation Process

The agent applies a policy where lowering severity requires evidence that mitigates the exploit’s impact, while raising severity demands proof that the environment exacerbates the risk. This includes verifying firewalls, allowlists, or other protective measures.

Recurring Patterns in Severity Changes

Six recurring patterns influenced severity changes. The most common, accounting for 32.3% of cases, involved resources with no active connections or orphaned assets. Downgrades also occurred for internet-inaccessible resources, those without active services, or those with strict access controls. Conversely, findings involving confirmed public exposure saw upgrades.

Mixed Outcomes in Rule Testing

Of 138 rules tested, 62 produced mixed outcomes in the same environment. For example, a security group rule was downgraded when internal load balancers were the only entry points but upgraded when internet-facing paths existed. Nearly half (49.0%) of the reclassifications relied on external evidence, such as data from connected resources or third-party security products.

Validation and Accuracy of the AI Agent

To validate the agent’s accuracy, the team conducted read-only probes on eight AWS accounts, cross-checking findings directly with cloud infrastructure. The agent’s conclusions matched live data 99.4% of the time for verifiable cases. When uncheckable findings were assumed incorrect, the accuracy dropped to 81.8%. The study focused solely on verifying findings, not on autonomous actions, highlighting the distinction between reading and acting on security alerts.

Limitations of the Study

The study focused on AWS (92% of regraded findings) and a single platform’s HIGH severity queue. Findings at MEDIUM or LOW severity, as well as incident data, were excluded. The research also did not assess whether upgraded findings were more likely to be exploited or if downgraded ones were less risky.

Conclusion and Implications

The work underscores the need for environment-specific analysis in cloud security, emphasizing that static severity ratings may not reflect real-world risks.

Researchers noted that rules lack dynamic environmental context, such as whether a flagged resource is connected to other assets or if workloads are active.