Salt Security Extends Agentic Security Platform with Autonomous Defense
Salt Security today announced Autonomous Defense for the Salt Agentic Security Platform, enabled by an expansion of Salt Workflows. Instead of stopping at an alert or ticket, Salt can automatically trigger defensive…
Expanded Salt Workflows close the gap between detection and resolution through automated enforcement, threat containment, and risk remediation across the enterprise
PALO ALTO, Calif., Oct. 28, 2026 /PRNewswire/ -- Salt Security today announced Autonomous Defense for the Salt Agentic Security Platform, enabled by an expansion of Salt Workflows. Instead of stopping at an alert or ticket, Salt can automatically trigger defensive controls to block malicious activity, revoke risky access, and initiate remediation across the systems customers already use.
Security teams have spent years improving detection. But detection is not resolution. When a risky agent, vulnerable API, or active attack is identified, response still often depends on manual handoffs and changes across disconnected systems. As AI accelerates the discovery and exploitation of weaknesses, that delay becomes a security risk of its own.
"Security cannot move at ticket speed when attackers move at machine speed. Autonomous Defense turns Salt's security intelligence into action, from blocking malicious activity and revoking risky access to enforcing protections through controls enterprises already use."
Aner Gelman, VP Product, Salt Security
From detection to defense
Autonomous Defense builds on the breadth and depth of the Salt Agentic Security Platform. The Agentic Security Graph connects AI agents, MCP servers, tools, and downstream APIs with context from exposure, source code, configuration, and runtime behavior. This intelligence helps identify dangerous paths and informs the policy-driven actions customers choose to enforce.
Using Salt Workflows and connected controls, security teams can:
- Revoke risky agent and MCP tool access. Disable unauthorized MCP connections, quarantine shadow tools, or remove excessive privileges through supported management controls.
- Block active exploitation. Push targeted blocking rules or virtual protections to existing WAFs, API gateways, and other enforcement points.
- Enforce AI and data protections. Update supported guardrail policies, block unsafe requests, or redact sensitive data through connected gateways.
- Remediate posture gaps. Trigger configuration changes to close exposed APIs, reinstate rate limits, or restore approved security settings.
BEFORE / WITH SALT AUTONOMOUS DEFENSE
BEFORE: DETECTION AND HANDOFF | WITH SALT: AUTOMATED ENFORCEMENT |
Detect → Manually triage → Open ticket → Risk remains | Detect → Graph + Workflows → Block / Revoke / Remediate |
Illustrative workflow. Actions depend on customer policies and connected enforcement capabilities.
SIEM enrichment, ServiceNow or Jira tickets, notifications, and audit logging remain available, but are no longer the end state. They can be part of an automated response that actively contains a threat or initiates remediation.
Autonomous when appropriate. Controlled when required.
Customers define which findings trigger immediate action, which changes require approval, and which enforcement points are used. This allows security teams to respond at machine speed while retaining control over sensitive operations and preserving an audit trail.
Flexible automation built into the platform
Salt has embedded a visual, drag-and-drop workflow builder directly into the Agentic Security Platform. With 200+ out-of-the-box connectors and a marketplace of Salt-built integrations, customers can design enforcement, governance, and remediation workflows across the tools they already use, without complex custom development.
Workflows can span security, infrastructure, IT, and collaboration systems without requiring organizations to standardize on a single gateway, agent framework, or response product.
For more information on Autonomous Defense and Salt Workflows, visit https://salt.security/blog/an-alert-doesnt-stop-an-attack-introducing-autonomous-defense
Closing the AI speed gap
Agentic systems can interact with multiple business systems and take consequential actions continuously. At the same time, offensive AI can accelerate reconnaissance, vulnerability discovery, and exploitation. Salt combines the Agentic Security Graph, posture intelligence, runtime detection, and automated enforcement so teams can move from identifying a risky path to acting on it in the same operational loop.
"An alert doesn't stop an attack. Action does. Salt secures the entire agentic path, from AI agents and MCPs to downstream APIs. Autonomous Defense puts that intelligence to work, helping security teams stop attacks and close dangerous paths before they cause business impact."
Roey Eliyahu, Co-founder and CEO, Salt Security
Salt Workflows is available to Salt Security customers today. Salt is migrating existing workflows to the new experience, with support for customer-specific requirements.
About Salt Security
Salt Security is the leader in agentic and API security, protecting the world's most innovative enterprises from AI agent and API attacks. The Salt Security Agentic Security Platform discovers agents, MCP servers, and APIs operating in an environment; governs the connections and permissions between them; monitors agent behavior at runtime; and eliminates vulnerabilities before they reach production. Salt Security was founded in 2016 and is backed by Sequoia Capital, S Capital, Tenaya Capital, Salesforce Ventures, Advent International, and other leading investors. For more information, visit salt.security.
Contact: Karl Bateson, Director of Communications, Salt Security
karlb@salt.security | 617.306.6275
View original content to download multimedia:https://www.prnewswire.com/news-releases/salt-security-extends-agentic-security-platform-with-autonomous-defense-302921621.html
SOURCE Salt Security
