How we secure Figma’s internal systems with agents

This post details the evolution of Figma's security alert triage system, moving from a manual, context-gathering process to a fully agentic system. Key technical contributions include the development of a RAG layer using AWS Bedrock Knowledge Bases and Amazon Kendra for surfacing historical alert context, including indexing structured alert fields and user-contributed investigation context from Slack. It also describes the addition of an agentic layer built with Tines, featuring intent routing to specialized agents with scoped toolkits (e.g., Okta, North Pole Security Workshop, Wiz) for automated investigation, code change generation, and PR creation. The post highlights metrics like a 20% drop in on-call pages due to automated severity downgrading and discusses the importance of auditability and scoped tool access for agents.