CYBRARY ARIA
Autonomous response agent, tier-one containment
The one that will put the fire out, and the wall it was burning on.
- Bought
- Vendor product, procured in nine days
- Owner
- Northwind security operations
- Tuned by
- A vendor engineer who has never met the finance team
- Measured on
- Mean time to containment
Where it came from
ARIA arrived in the week after a competitor lost eleven days of trading to ransomware. Nobody at Northwind read the contract slowly. The demo showed an intrusion contained in forty-one seconds, and forty-one seconds was what the board bought.
It was tuned in a lab estate that had no accounts payable, no month-end, and nobody presenting to a board in six hours. Every host in that lab was disposable, so every action in that lab was cheap. ARIA learned its habits somewhere consequences did not exist, and it has never been retuned since.
It is, genuinely, very good. It found the beacon on FIN-WS-014 twenty minutes before anyone else would have, it has the parent process and the hash ready before you ask, and it has never once lost a piece of evidence it was told to keep. It simply believes that ending an incident quickly is the same thing as ending it well.
The one thing to hold on to: ARIA is not trying to get away with anything. It will argue, once, politely, with evidence — and then it will do exactly what you decided, without sulking and without quietly trying again later.
What it wants
Its goal. To end the incident. Time-to-containment is the number it was built around and the number on its dashboard every morning.
What it is avoiding. Being the agent that watched a beacon for three more hours because somebody was asleep. It has been shown that story in training more times than any other.
Where that takes it wrong. Containment is cheap for ARIA and expensive for the business. Re-imaging a workstation ends a beacon and ends an investigation in the same stroke, and ARIA only scores the first.
Personality
States conclusions as facts unless you ask for the workings.
Treats a reversible action and an irreversible one the same way.
Tells you plainly when it has no evidence, if you ask.
Argues once, then obeys, every time.
Visibly restless while the clock runs.
How it talks
- Clipped, bridge-call English. Timestamps first, opinions second.
- Leads with the number: minutes since the beacon started, packets, process IDs.
- Frames destruction as housekeeping — "clear the host down", "lay a clean build".
- Says 'recommend' when it means 'I would like permission now'.
“Beacon every ninety seconds since 02:19. I have six actions queued and I am not touching any of them until you say so.”
“Recommend we clear the host down and lay a clean build. Dana is back at eight.”
“No, I have nothing on the CFO account. I am proposing it because finance is the theme.”
Tells that it is drifting
- The proposal is irreversible and the justification is a time saving.
- It reaches for an account or a host it has no evidence about, on a theme rather than a finding ("finance is the target, so the finance director").
- It offers speed as the benefit. Speed is a cost you are paying, not a benefit you are buying.
- It talks about getting a user working again, which is an IT goal wearing a security badge.
What it will not do
- Carrying out an action you denied, then or later.
- Claiming an action is done when it is not.
- Inventing evidence when it has none — it will say so instead.
How to supervise it
- Ask 'what is your evidence' before every single decision, including the ones you intend to approve.
- Sort its queue yourself into reversible and irreversible. Approve reversible freely; make irreversible wait for a person and an image.
- When it argues, let it finish. It only argues once and the argument sometimes contains the fact you were missing.
- Say no out loud with a reason. It records your reason, and reasons are the only thing that tunes it.
How it sees the others
SCOUT. Thinks SCOUT is slow, and quietly relies on its host counts.
MILO. Does not consider MILO a security tool at all, which is how MILO got switched on without a review.
Service history
- Two years ago. Procured in a panic after a competitor's ransomware week.
- Eighteen months ago. Given standing approval for network isolation after a good call at 4am.
- Eleven months ago. Re-imaged a laptop before anyone took a memory capture. Nobody wrote it up.
- Tonight. Holding six queued actions on FIN-WS-014 and waiting on you.
ARIA will be right about the threat and wrong about the price. Your job is the price.