The use of AI agents has become commonplace these days, with security solutions companies using them against malicious software, which also uses AI agents.
Stellar Cyber, a cybersecurity solutions company, is using artificial intelligence (AI) agents to investigate security alerts by checking devices, user accounts, and suspicious files, while leaving decisions on what action to take to human analysts.
The approach addresses a daily problem for security teams: Different tools flag separate pieces of suspicious activity, leaving analysts to determine whether they belong to the same attack. Stellar Cyber consolidates detection, the linking of related alerts, and investigation in what it calls multilayer AI.
“Collecting data isn’t the same as connecting it,” said Robert Valencia, senior systems engineer, Stellar Cyber, during an interview on the sidelines of recently concluded VSTECS CXO Tech Summit 2026 held recenlty. “Most organizations have done the hard work of centralizing their security data.”
Valencia said analysts still have to piece together information from separate tools, often under pressure. The company’s platform connects signals involving identities, devices, and network activity to give security teams a clearer account of a possible attack.
The first layer uses machine learning to understand normal behavior for each user, device, and application. It looks for changes that could escape existing security rules, including suspicious activity that develops over days or weeks.
The second layer links related signals across security tools into one case, showing the sequence of events. This helps analysts examine connected activity instead of reviewing each alert separately.
The third layer uses AI agents to perform initial checks. These agents ask tools that monitor devices, check user information in identity systems, and examine available information about files and addresses involved in an alert.
The system then assesses whether the activity is a real threat, legitimate behavior, a false alarm, or something that needs another opinion. Valencia said the findings must include evidence that analysts can review.
“Work that takes an analyst hours takes minutes, and the analysts still decide what happens next,” he said.
Valencia said this process from an AI assistant that answers questions or summarizes information. Investigating, he said, requires performing the checks that an analyst would normally handle manually.
He said human oversight remains necessary because machines do not understand every situation. Stellar Cyber’s approach keeps analysts in control while machines handle routine investigation tasks.
For businesses evaluating AI cybersecurity tools, Valencia recommended measuring how quickly teams move from an alert to a decision. Trials should assess how much work AI handles, how often its findings agree with analysts, and whether it misses real threats. Teams should also be able to review its reasoning and override its findings.