Empowering Cybersecurity Agents with Structured Knowledge

Consider two detectives assigned to different cases. One detective faces a jigsaw puzzle with missing pieces—events detached from their context, motives unstated, and relationships vague. The other detective benefits from a comprehensive overview, where connections are clear before even stepping into the investigation. The latter detective is likely to solve the case more swiftly, not due to superior intelligence but because the information available is organized and intelligible.

This analogy reflects the state of cybersecurity AI agents. Imagine two agents equipped with advanced language models, both designed to thwart attacks. They possess an understanding of risks and defense mechanisms, yet their operational environments differ dramatically. One agent is inundated with chaotic alerts and fragmented data, while the other operates within a structured framework that outlines the relationships between assets, vulnerabilities, and organizational context. Their efficiency is dictated not by intelligence alone but by the clarity and organization of the information they leverage.

Agentic Intelligence and Operational Models

The crux of agentic intelligence lies in creating a representation of the operational landscape that enhances decision-making, transforming randomness into expected outcomes. As these agents increasingly take action rather than merely offering answers, the effectiveness of their actions is closely tied to the quality of the structured context they navigate. A rich operational model gives agents the foundation needed to achieve meaningful results.

Human learning offers valuable insights into this process. Progress has never solely rested on access to information; it depends significantly on how that information is organized and contextualized. Trustworthy knowledge emerges from a collaboration of credible sources, relevant connections, and preserved context. Neural pathways shaped by observation and interaction drive intelligence. In contrast, modern AI models primarily learn from vast data, lacking direct environmental interactions. Thus, they possess broad knowledge but miss real-time awareness of their operational context.

The Need for Structured Context in Cybersecurity

In cybersecurity, human analysts continually blend their observations and institutional insights into a cohesive understanding of their environment. AI agents, on the other hand, require explicit operational models to function effectively. Operational elements such as identities, dependencies, and evolving evidence cannot be presumed from language alone; they must be explicitly defined within the agent's knowledge framework. To be effective, AI must not just react to signals but also understand the context behind those signals.

Our work at Recorded Future highlighted key learnings on this front. Early versions of our agents weighed open-source data and proprietary intelligence equally, leading to generic outputs devoid of depth. After iterating the structure of our AI agents to prioritize insights drawn from the Recorded Future Intelligence Graph®, which encapsulates years of expert analysis and decision-making, we observed a marked improvement in analytical rigor and confidence in the outputs. It wasn't a leap in the AI's capabilities but rather a significant upgrade in the nature of the data it was processing.

Constructing an Effective Operational World

The landscape of AI and its frameworks is rapidly evolving, lessening the competitive edge of model choice. The real challenge lies in creating a robust operational representation of an organization’s knowledge, which remains difficult to replicate. Without explicit knowledge structures, agent performance suffers—knowledge that resides in implicit, undocumented forms cannot effectively inform AI actions.

Take the simple yet profound Priority Intelligence Requirement (PIR): “What is a threat to our organization?” The complexity of such a query becomes apparent when considering that an answer needs to account for external threats alongside a company’s unique assets and risk profile. Developing this context is essential, requiring active analysis rather than a passive deployment of AI tools. Only by establishing an organized representation can agents achieve coherent reasoning and decisive action.

Core Principles for Structuring AI Knowledge

Building an effective operational framework for AI in cybersecurity revolves around several key principles:

• Prioritize Structure Before Reasoning: A competent AI system should leverage an organized representation of real-world relationships, enabling agents to reason effectively without needing to reconstruct understanding from unstructured data.
• Establish Provenance as a Key Element: Just as human analysts scrutinize the validity of sources, agents require traceable evidence assessing the credibility and relevance of the information they process, transforming raw data into actionable intelligence.
• Make Verification Simpler than Investigation: For trust to flourish, AI recommendations should easily convey the rationale and evidence backing them, enhancing confidence over imposing mental labor upon human analysts.
• Emphasize Efficiency Through Intellect: More reasoning does not equate to better intelligence; rather, it involves precise thinking and directing computational power toward meaningful insights.
• Maintain Reasoning as Much as Data: Sharing reasoning processes across deployments promotes cumulative learning and consistency, vital for maintaining clarity in complex investigations.
• Ensure Lifespan of Intelligence Beyond Interfaces: As platforms and tools evolve, a strong structural foundation of intelligence should remain adaptable and accessible, not tied to specific applications.

As organizations adapt their cyber capabilities, it's essential to keep in mind the human element in the mix. Instead of replacing analysts, intelligent systems should bolster their expertise. AI's true value emerges not from autonomous thinking but by enhancing human decision-making.

A key takeaway is that intelligence transcends mere consumption—it's an integral part of the reasoning environment. Competitive advantage will be found in those who cultivate systems where knowledge is organized, evidence is transparent, and human judgment is at the forefront. The path forward is clear: While models will change and interfaces may evolve, the essential architecture of enterprise intelligence remains foundational.