Streamlining Security Investigations with Agents

Slack made evidence review an explicit stage of its agent-based security investigations. Specialist agents gather findings, a critic examines their claims and supporting tool results, and a director decides which questions to pursue next. Application code coordinates these separate tasks, giving the investigation more structure than instructions inside one large prompt.

In an edited example from a real investigation, the critic noticed exposed access credentials that an expert had overlooked. The director redirected the investigation, and the issue went to the responsible service team for remediation. The example shows what checking the underlying evidence can add, while keeping human teams responsible for resolving the finding.