Salt Security has announced Autonomous Defense for its Agentic Security Platform, expanding its Salt Workflows capabilities to automate threat containment, enforcement and remediation. The update enables security teams to trigger actions such as blocking malicious activity, revoking risky access and initiating configuration changes through existing enterprise tools.
The announcement addresses the delay between detecting a threat and taking action. Salt says response processes often depend on manual handovers across disconnected systems, leaving risks unresolved while teams investigate alerts and raise tickets. As AI accelerates the discovery and exploitation of weaknesses, the company argues that these delays can increase exposure.
“Security cannot move at ticket speed when attackers move at machine speed,” said Aner Gelman, VP Product at Salt Security. “Autonomous Defense turns Salt’s security intelligence into action, from blocking malicious activity and revoking risky access to enforcing protections through controls enterprises already use.”
The capabilities draw on Salt’s Agentic Security Graph, which connects AI agents, Model Context Protocol (MCP) servers, tools and downstream APIs with information from source code, configurations, exposure and runtime behaviour. This context helps identify potentially dangerous paths through an organisation’s systems and informs the responses customers choose to automate.
Through Salt Workflows and supported connected controls, security teams can disable unauthorised MCP connections, quarantine shadow tools and remove excessive privileges. They can also push blocking rules to web application firewalls and API gateways, update AI guardrail policies, or trigger configuration changes to address exposed APIs and missing rate limits.
Customers determine which findings trigger immediate action and which changes require approval. They also select the enforcement points used, allowing teams to retain oversight of sensitive operations and maintain an audit trail. Ticketing, notifications and SIEM enrichment remain available as part of the response process.
Salt has embedded a visual, drag-and-drop workflow builder into the platform, supported by more than 200 out-of-the-box connectors and a marketplace of Salt-built integrations. According to the company, workflows can span security, infrastructure, IT and collaboration systems without requiring customers to standardise on a single gateway, agent framework or response product.
“An alert doesn’t stop an attack. Action does,” said Roey Eliyahu, co-founder and CEO of Salt Security. “Salt secures the entire agentic path, from AI agents and MCPs to downstream APIs. Autonomous Defense puts that intelligence to work, helping security teams stop attacks and close dangerous paths before they cause business impact.”
Salt Workflows is available to Salt Security customers now. The company is migrating existing workflows to the new experience, with support for customer-specific requirements. Automated actions depend on customers’ policies and the capabilities of their connected enforcement tools.
