TechPrufer
Sign inGet started

Blogs›Figma›Security Alert Triage Agents

Security Alert Triage Agents

Security Alert Triage Agents

3
posts
2026

Figma is building an agentic system to automate security alert triage. This system leverages retrieval-augmented generation (RAG) to provide historical context for alerts and then uses specialized agents with scoped toolkits to investigate and resolve issues. The system aims to reduce on-call burden and improve the speed and accuracy of security incident response. This post details the evolution of the security review process, focusing on improving precision and recall through agentic systems, and introduces 'skills' which are reusable sets of instructions that can be taught to the Figma agent to automate recurring workflows and apply team-specific expertise, such as simulating feedback styles, upholding UX writing standards, or providing a new user's perspective. Skills can also integrate with external tools via MCP connectors to log feedback, bring research into the room, or back design directions with data.

2026

How we secure Figma’s internal systems with agents

7/29/2026

This post details the development of a new security alert triage system at Figma. It describes the implementation of a RAG layer using AWS Bedrock Knowledge Bases and Amazon Kendra to index and retrieve historical alert data and investigation context. It also outlines the addition of an agentic layer built with Tines, which routes requests to specialized agents with access to tools for Okta, endpoint security (Santa), and cloud security (Wiz) to automate alert investigation and response. The post highlights the technical details of indexing, querying, and agent tool integration, including code snippets for attribute definition, query building, and context addition.

How Figma stays ahead of vulnerabilities with agents

7/23/2026

This post details the technical evolution of Figma's agentic security system, specifically focusing on the pull request review component. Key contributions include: developing a shared policy that serves as a threat model, implementing mechanisms to measure and improve precision (author ratings) and recall (replaying known-bad commits), migrating the reviewer to a TypeScript service for better maintainability and observability, ablating prompts to leverage newer frontier models, and adding an adjudicator to improve recall by re-examining borderline dismissals. The post also outlines the metrics used (precision, recall, fix rate) and the evaluation framework for measuring recall with a corpus of real vulnerabilities.

Got skills? Make the Figma agent a better collaborator

7/1/2026

Introduces 'skills' as a mechanism to teach the Figma agent reusable workflows and team-specific expertise. Details how skills can be used for simulating feedback, upholding standards, and providing new user perspectives. Explains how skills integrate with external tools via MCP connectors for logging feedback, incorporating research, and backing design decisions with data.