https://www.contraforce.com/assets/security-delivery-agent-BvfWNbUG.js

1import{u as m,a as g,j as t}from"./index-CY77aiA3.js";const f="rgba(148,163,184,0.32)",v="rgba(148,163,184,0.14)",x="#0F1A2E",w="rgba(59,130,246,0.12)",l="var(--color-cf-blue-light, #3B82F6)",k="var(--color-success, #10B981)",o="var(--font-mono, monospace)",d=[{d:"M 280 56 V 92",delay:0},{d:"M 280 130 V 162",delay:.18},{d:"M 204 206 H 124 V 280",delay:.36},{d:"M 356 206 H 440 V 280",delay:.42},{d:"M 124 318 V 372 H 230",delay:.58},{d:"M 440 318 V 372 H 330",delay:.64}],b=[{key:"triage",label:"TRIAGE",x:224,y:18,w:112,h:38,delay:0},{key:"investigate",label:"INVESTIGATE",x:212,y:92,w:136,h:38,delay:.3},{key:"auto",label:"AUTO-RESPOND",x:56,y:280,w:136,h:38,delay:.75},{key:"human",label:"HUMAN APPROVAL",x:372,y:280,w:136,h:38,delay:.8},{key:"close",label:"CLOSE",x:230,y:353,w:100,h:38,delay:1}];function A({active:c,className:h=""}){const i=m(),[u,y]=g({threshold:.35}),a=(c??y)||i,p=e=>({strokeDashoffset:a?0:1,transition:i?"none":"stroke-dashoffset 1.1s var(--ease-out-expo)",transitionDelay:a&&!i?`${e}s`:"0s"}),r=(e,n=a)=>({stroke:n?l:f,fill:n?w:x,transition:i?"none":"stroke 0.5s var(--ease-out-expo), fill 0.5s var(--ease-out-expo)",transitionDelay:a&&!i?`${e}s`:"0s"}),s=e=>({fill:a?"var(--color-text-primary, #F1F5F9)":"var(--color-text-disabled, #64748B)",transition:i?"none":"fill 0.5s var(--ease-out-expo)",transitionDelay:a&&!i?`${e}s`:"0s"});return t.jsxs("div",{ref:u,className:`relative w-full h-full flex items-center justify-center p-6 ${h}`,children:[t.jsx("style",{children:`
2        @keyframes cg-gbflow-pulse {
3          0%, 100% { opacity: 0.3; transform: scale(1); }
4          50% { opacity: 0.85; transform: scale(1.03); }
5        }
6        .cg-gbflow-ring {
7          transform-box: fill-box;
8          transform-origin: center;
9          opacity: 0.5;
10          animation: cg-gbflow-pulse 2s ease-in-out infinite;
11        }
12      `}),t.jsxs("svg",{viewBox:"0 0 560 420",className:"w-full h-full max-w-[560px]",preserveAspectRatio:"xMidYMid meet","aria-hidden":"true",children:[d.map((e,n)=>t.jsx("path",{d:e.d,fill:"none",stroke:v,strokeWidth:"1",strokeDasharray:"3 5"},`guide-${n}`)),d.map((e,n)=>t.jsx("path",{d:e.d,fill:"none",stroke:l,strokeOpacity:"0.7",strokeWidth:"1.5",strokeLinecap:"round",pathLength:"1",strokeDasharray:"1",style:p(e.delay)},`seg-${n}`)),t.jsx("text",{x:"160",y:"199",textAnchor:"middle",fontFamily:o,fontSize:"9",letterSpacing:"0.1em",style:s(.5),children:"YES"}),t.jsx("text",{x:"400",y:"199",textAnchor:"middle",fontFamily:o,fontSize:"9",letterSpacing:"0.1em",style:s(.55),children:"NO"}),b.map(e=>t.jsxs("g",{children:[t.jsx("rect",{x:e.x,y:e.y,width:e.w,height:e.h,rx:"9",strokeWidth:"1.25",style:r(e.delay)}),t.jsx("text",{x:e.x+e.w/2,y:e.y+e.h/2+3.5,textAnchor:"middle",fontFamily:o,fontSize:"10.5",letterSpacing:"0.08em",style:s(e.delay),children:e.label})]},e.key)),t.jsx("polygon",{points:"280,162 356,206 280,250 204,206",strokeWidth:"1.25",style:r(.5)}),t.jsx("text",{x:"280",y:"201",textAnchor:"middle",fontFamily:o,fontSize:"9",letterSpacing:"0.1em",fill:"var(--color-text-disabled, #64748B)",children:"CONFIDENCE GATE"}),t.jsx("text",{x:"280",y:"216",textAnchor:"middle",fontFamily:o,fontSize:"10.5",letterSpacing:"0.06em",style:s(.5),children:"CONF ≥ 0.9?"}),t.jsx("rect",{className:"cg-gbflow-ring",x:"366",y:"274",width:"148",height:"50",rx:"12",fill:"none",stroke:k,strokeWidth:"1.5"}),t.jsxs("g",{children:[t.jsx("rect",{x:"394",y:"263",width:"92",height:"16",rx:"8",fill:"#0F1A2E",stroke:"rgba(16,185,129,0.45)",strokeWidth:"1"}),t.jsx("text",{x:"440",y:"274",textAnchor:"middle",fontFamily:o,fontSize:"8",letterSpacing:"0.1em",fill:"#34D399",children:"HUMAN DECIDES"})]})]})]})}const E={slug:"security-delivery-agent",title:"What is a Security Delivery Agent? | ContraForce",description:"A Security Delivery Agent performs security operations work end to end: triage, investigation, response, documentation, and detection tuning, all under human-governed procedures. Not a chatbot. Not a script.",hero:{question:t.jsxs(t.Fragment,{children:["What is a Security",t.jsx("br",{}),"Delivery Agent?"]}),lede:"Not a chatbot waiting for a prompt. Not a script that breaks on the case nobody scripted. A different kind of worker."},definition:{term:"Security Delivery Agent",kind:"noun",text:"A Security Delivery Agent performs security operations work end to end: it triages an incident, investigates across data sources, gathers and documents evidence, and executes response actions, following codified procedures, within approval gates a human sets. Unlike a copilot, it doesn’t wait to be asked. Unlike SOAR automation, it does not break on the case nobody scripted."},sections:[{type:"editorial",kicker:"The distinction",heading:"Not a chatbot. Not a script.",paragraphs:['The last three years produced two kinds of "AI for security," and both stop short of the work. The assistant summarizes an incident and suggests next steps, then waits. The decision, the click, the ticket, the write-up: still yours. Helpful on a good day. Idle capacity on most.',"The script (SOAR in its many costumes) executes, but only along paths someone scripted in advance. The moment an incident deviates from the script, it stalls, escalates, or worse, does exactly the wrong thing confidently.","A Security Delivery Agent occupies the space between: it investigates like an analyst (forming hypotheses, pulling evidence, adapting to what it finds) and it executes like softw

12are: instantly, consistently, with a complete record. The judgment calls that matter still route to a human. Everything else just gets done."]},{type:"namedTrio",heading:"Three workers, compared",intro:"Same alert, three very different amounts of work left on your desk.",items:[{icon:"ri-chat-3-line",name:"The assistant",description:"Advises. Summarizes the incident, drafts the query, suggests the next step, and waits for a human to do it. Capacity gained: minutes."},{icon:"ri-git-branch-line",name:"The script",description:"Executes, rigidly. Runs the exact path someone scripted, and stalls the moment reality deviates from it. Breaks quietly as your environments multiply."},{icon:"ri-robot-2-line",name:"The delivery agent",description:"Investigates, decides within your guardrails, executes, and documents, end to end. Escalates to a human exactly when your procedures say it should."}]},{type:"editorial",kicker:"Anatomy of one run",heading:"What happens when an incident fires.",paragraphs:["An identity incident lands from one of the environments you protect. The agent classifies it, pulls sign-in history, device posture, and mailbox rules, and correlates what it finds against the rest of the environment. It writes its reasoning down as it goes.","Then it hits the gate. The Gamebook (your procedure, codified) says containment above this confidence threshold requires an approval. A human sees the whole investigation with evidence attached, and makes one decision instead of forty clicks. Approve, and the agent revokes sessions, resets credentials, closes the ticket, and files the audit trail.","Elapsed time: minutes. Human attention spent: one decision. That ratio (judgment in, toil out) is the entire point."],visual:t.jsx("div",{className:"rounded-xl border border-border bg-[#0A1626] p-8",children:t.jsx(A,{})})},{type:"numbered",heading:"What one agent run produces",intro:'Every completed run leaves three artifacts behind. Ask any "agentic" tool to show you all three.',items:[{label:"An investigation with evidence attached",description:"Not a verdict to re-check, but a documented chain of what was queried, what came back, and why it mattered. The write-up your best analyst would produce, on every incident, without being asked."},{label:"A decision made inside your guardrails",description:"Every consequential action passes through the thresholds and approval gates your team configured. The agent moves fast precisely because the boundaries are explicit."},{label:"A closed outcome, written down",description:'The ticket updated, the response executed, the audit trail complete. Not "insight." An outcome someone would otherwise have had to deliver by hand.'}]}],related:{eyebrow:null,headline:"Go deeper on delivery agents",items:[{href:"/gamebooks-sop-enforcement",icon:"ri-book-2-line",title:"Gamebooks & operating procedure enforcement",description:"How procedures become guardrails agents actually follow."},{href:"/resources/ai-soc-agents-for-mssps",icon:"ri-cpu-line",title:"Evaluate AI SOC agents",description:"A practical guide to testing agents in multi-tenant security operations."},{href:"/platform",icon:"ri-stack-line",title:"The ContraForce platform",description:"How the delivery loop runs end to end."},{href:"/agentic-security-delivery/security-delivery-gap",icon:"ri-ruler-2-line",title:"The Security Delivery Gap",description:"The problem these agents exist to close."}]},faqs:[{question:"How is a Security Delivery Agent different from a SOAR automation?",answer:"SOAR executes a pre-scripted path and fails when an incident deviates from it. A delivery agent investigates first (forming a picture from live evidence) then acts within the thresholds and approval gates your procedures define. Scripts automate the known; agents handle the case nobody scripted."},{question:"Do Security Delivery Agents replace analysts?",answer:"No. They replace the toil around analysts: the pivoting, the copying, the re-checking, the write-ups. Humans keep every consequential decision, and that boundary is enforced by the platform, not by a policy document."},{question:"What keeps an agent from acting outside its authority?",answer:"Gamebooks. Procedures, confidence thresholds, and approval gates are codified per action type. Anything above the line routes to a human for approval, and every action the agent takes is logged to an audit trail."}],cta:{statement:"Watch an agent close its first incident.",subheadline:"Connect one workspace and evaluate a governed investigation in your environment.",primaryCta:{label:"Connect One Workspace"},secondaryCta:{label:"See the platform",href:"/platform"}}};export{E as default};