Two 2026 awards, and what putting an AI security workforce into production teaches us about the hard parts.

Bricklayer AI has recently won two cybersecurity awards: the Fortress Cybersecurity Award in the Agentic AI Security Platform category, and the CyberSecurity Breakthrough Award for Agentic AI Security Platform of the Year. Bricklayer gives security teams AI agents that work together as a coordinated team, share what they learn, and take on work across security.

I’m glad to have the recognition. But awards make me ask a more useful question: what, specifically, was recognized? Part of the feedback the Fortress judges gave on why we won was about trust: whether you can see what an agent is doing, intervene when it’s wrong and audit it, and whether it holds up in production rather than in a demo. That isn’t the flashy part of agentic AI. It’s the hard part. It’s also what we learned by putting agents to work in real security teams, so I want to tell it in the order we learned it.

Where it started

When I joined Bricklayer, I believed AI was going to change the economics of security. I’d spent years in application security watching LLMs collapse the barriers for attackers, as I wrote about in Why I Joined Bricklayer. Attackers were iterating faster and faster. Defenders were still organized around human analysts moving between systems, tools and procedures. I also believed that bolting AI onto those workflows wouldn’t be enough. That conviction has only gotten stronger.

The SOC is the obvious place to start, which is why so much of the early conversation about agentic security centers on the agentic SOC. The work is investigation, research, coordination and repetitive analysis across a lot of systems. It’s a natural fit, and it’s where we started too.

But we never thought the problem stopped there. Threat intelligence teams have to connect information from many sources. Vulnerability teams have to understand exposure across sprawling environments. Threat hunters have to form hypotheses, gather evidence and correlate findings. Incident response takes coordinated work across people, tools and procedures. The SOC was the starting point, not the boundary.

An AI feature is not an AI workforce

There’s no shortage of AI that can do one security task. An agent can investigate an alert, analyze a vulnerability, research a threat actor or summarize an incident. Those capabilities are useful, and they’re getting easier to build.

But those functions aren’t separate jobs. The work is connected. A vulnerability investigation might draw on an attack surface management platform, a vulnerability scanner, cloud inventory, XDR and threat intelligence. An incident can require several kinds of expertise and dozens of pieces of evidence. A threat intelligence analyst has to combine public reporting with what’s happening inside the organization before deciding what actually matters.

Connected work needs agents that share context, coordinate, operate within defined authority and leave a record the organization can understand. What they learn should also outlast any single session. That’s the difference between an AI feature and an AI workforce. The unit of change isn’t an individual capability. It’s how security work gets done.

What production teaches us

Production is where that idea gets tested. As of the end of September, Bricklayer’s coordinated AI workforce has completed more than 2 million tasks and saved the equivalent of an estimated 332 analyst years. What interests me more is what that time made possible: work that teams previously lacked the capacity to keep up with, and coordination across the silos that make investigation and response hard to execute.

Production also shows you what breaks. You find where an agent doesn’t have enough context, where two procedures need to share information, and where a workflow that looks simple on a whiteboard falls apart across millions of records, mixed data sources, and multiple business units.

That’s how we ended up building the Agent-Native Data Plane. As we pushed agentic workflows into larger environments, we ran into constraints with how multi-agent architectures handle information. Data gets retrieved, converted to text or JSON and dropped into one model’s context. When another agent needs it, it retrieves and interprets it all over again. As agents, procedures and data sources multiply, you get duplicated data, lost detail and provenance, inconsistent governance, and findings that vanish when the session ends.

So the requirement became persistent, governed access to shared enterprise information. Instead of every agent building its own version of the evidence, agents work against persistent data at scale and pass their findings to the agents that need them.

A vulnerability exposure spot check use case shows what that looks like. For a large organization with dozens of business units, “Does this newly disclosed vulnerability affect us?” sounds like a simple question. Answering it can mean pulling exports from half a dozen tools and reconciling them by hand across several thousand assets. Bricklayer runs it as a coordinated workflow. One procedure identifies the vulnerabilities that warrant attention. Another checks the attack surface, vulnerability scanner, cloud inventory and XDR data. The results are normalized, duplicates resolved, and assets categorized by severity, exploitation status and internet reachability. Because the agents work against the same persistent data instead of their own copies, that one body of evidence supports both a global report and the asset-level detail each business unit needs to act.

The unglamorous parts

This is why the Fortress judges’ comments resonated with me. They pointed to our Multi-Agent Context Engineering (MACE) architecture, which creates, structures and governs context across agents, procedures and sources of enterprise information. Paired with the Data Plane, which gives agents persistent access to the underlying data, it lets an investigation build on what’s already known instead of rebuilding context at every handoff.

They also spoke directly to trust. The questions that kept AI on the sidelines in security were simple: can I see what it’s doing, can I intervene when it’s wrong, and can I audit it? The Bricklayer Workbench, where analysts and agents work side by side with visibility into every step and the ability to rerun a task or redirect an investigation, is built for the first two. Every agent action across every procedure is auditable, which covers the third. The judges also noted our staged delivery model, validating each capability in production before introducing the next. That’s how we think autonomy should arrive: earned, not assumed. It’s also how Agentic Approvals works. Teams can start with human approvers and delegate defined decisions to approver agents as their confidence grows, while anything outside an agent’s requirements stays with people.

CyberSecurity Breakthrough came at it from a different angle and landed in the same place. The program pointed to AI tools operating in silos, each unaware of what the others have learned, and to the need for a coordinated AI workforce where humans stay in control and every decision is transparent.

None of this makes for a good demo. All of it becomes unavoidable the moment real work is running through the system. It’s also why I don’t see the current wave of agentic security as a race to add more agents. The harder problem is building the harness and operating model that let agents become part of a security team.

The category is still being defined

Access to foundation models is broadly available. But the model is only part of what it takes to run an AI workforce in production. Much of the rest is the harness around it: the shared context, coordination, governance and human oversight that let agents do real work without losing what they’ve learned or exceeding the authority they’ve been given. That’s the part the industry is still working out.

If attackers can use AI for reconnaissance, exploit development and continuous operation with less human involvement, defenders can’t answer by adding more tools or asking the same teams to process more work. That is where the conversation about an AI security workforce becomes more than a question of scale or efficiency. It becomes a question of how security teams will operate: coordinating agents across the work, preserving the context those agents generate, governing what they’re allowed to do, and keeping humans in control of the decisions that matter.

The goal was never to replace the people doing this work. It’s to change how much a security team can take on, while humans stay responsible for objectives, authority, risk and judgment.

The SOC is where we started. It isn’t where this ends.

The category is young. The technology is moving quickly. And there is still a lot we need to prove. But these awards are a meaningful signal that what we’re building is beginning to stand out. We’ve spent our time building the product, putting it in the hands of enterprise security teams and learning from what happens in production.

There is still a lot to build.

Evaluating agentic SOC platforms? We’ve put together a practical guide to the criteria and harder problems that matter for enterprise security teams. How to Evaluate an Agentic SOC Provider →