Keeping clients' computers safe and profitable for over 30 years

Red, Blue, and Green Agents

Preview: AI agent teams—Red, Blue, and Green—are transforming cybersecurity by autonomously detecting, assessing, and patching vulnerabilities at machine speed, as seen in UK and Microsoft initiatives.

AI Bot Teams

The United Kingdom’s National Cyber Security Centre (NCSC) has unveiled Cyber Shield, a blueprint for a national-scale agentic AI cyber defense system that primarily utilizes paired red and blue AI agents to identify vulnerabilities and remediate threats at machine speed. I wrote an article in April explaining AI agents. While the UK initiative focuses on red and blue agents, Microsoft recently announced Project Perception, a cybersecurity model that employs red, blue, and green AI agent teams. These probe, assess, and remediate security gaps. They represent a parallel commercial approach to autonomous defense. This allowed them to find and patch 400 security flaws in August.

Security teams and even countries are moving toward using AI agents to protect their websites and data centers. The current thinking involves the use of three distinct agents.

1. The Red Team or Agent. This is an AI agent designed and trained to find and attack vulnerabilities. It runs continuously. However, rather than breaking a site, it documents the issue and hands its findings over to the Blue Agent.
2. The Blue Agent is designed and trained to take potential vulnerabilities and assess them. It determines how critical it is and what the potential for use and damage is. It assesses the threat. Not only that, but it does this autonomously and quickly from any report coming in from the Red Agent. They are part of the same team but trained specifically for a specific task.
3. The blue agent then turns in a report to the green agent. This agent was designed and trained to assess the results from the red agent and check for the true root cause. To examine how changes could affect other parts of the system and then code mitigations. It may implement the solution immediately or request confirmation from a human.

These three distinct agents are trained for 3 distinct specialties and run not only 24×7 but also at computer, not human, speed. This means that a vulnerability could be patched in less than an hour from the time it was discovered.

Further reading

• Wiz.io blog: https://www.wiz.io/blog/introducing-wiz-agents