Detection to Decision: Agentic AI at the Edge for Security Operations

Traditional edge security systems excel at signal collection and anomaly detection, but they still rely heavily on centralized analysis or human intervention to determine next steps. This session explores how agentic AI deployed at the edge moves security operations from passive monitoring to autonomous, goal-driven defense.

We will examine reference architectures in which edge-based AI agents continuously observe local conditions, reason over incomplete or noisy data, coordinate with peer agents, and take real-time action to contain threats. Through concrete use cases—including isolating compromised IoT devices in smart facilities, detecting and containing lateral movement in operational technology (OT) networks, preventing point-of-sale tampering in retail environments, and responding to rogue base stations or edge node compromise in telecom deployments—the talk demonstrates how local autonomy enables faster and more resilient security outcomes.

The session also covers practical considerations such as model selection under compute, memory, and power constraints; establishing trust boundaries between agents and centralized control planes; aligning autonomous actions with organizational security policy; and designing fail-safe mechanisms for high-impact decisions. We’ll explore how agentic systems change incident response workflows by reducing mean time to respond (MTTR) and shifting human involvement from reactive intervention to supervisory oversight.

Attendees will leave with a clear understanding of when and where agentic edge security delivers real value, how it differs from traditional ML-based detection pipelines, and what it takes to deploy, govern, and scale autonomous security agents in production edge environments.