Salesforce Builds AI Agent to Sort Security Threats Automatically

The security team at a large company has one of the worst jobs in modern business. Every day, they wake up to a wall of alerts, most of which are noise, some of which are genuine emergencies, and the only way to tell the difference is to look at each one. The volume keeps growing, the headcount does not. Salesforce's security team covers 80,000 employees plus the cloud infrastructure that millions of businesses worldwide rely on. They built an internal AI agent, called SATA, specifically to handle the first sorting step. Before SATA, every alert required a human analyst to gather context from multiple systems, weigh it up, and decide whether to escalate. SATA now does that gathering and initial sorting automatically. The design is straightforward. SATA looks at incoming alerts, pulls relevant data from logs and case systems, and assigns a confidence level to its decision. High-confidence assessments move through without a human in the loop. Low-confidence ones go straight to an analyst. This split means the team's attention is concentrated where it actually matters. Before going live, the team tested SATA against historical cases and found roughly 95% agreement with what experienced analysts had decided on the same situations. That number matters because it sets the floor for trust. It also shows where the gaps are, which is exactly the kind of information you need before putting an automated system into a high-stakes environment. The broader context here is important. Security teams across industries are drowning in volume. Studies show the median security team sees around 960 alerts per day; at larger enterprises, that number crosses 3,000. Around 40% of those alerts are never investigated at all. One study found it takes an average of 70 minutes to fully work through a single alert. Nobody has enough people to close that gap by hiring. Salesforce is also using AI agents elsewhere in its security operation. A separate team used the same platform to handle a 30% year-on-year increase in vulnerability reports from external researchers, without adding a single person. Another team uses it to pre-screen supplier security questionnaires, saving engineers roughly 30% of their time on that task alone. Together, these deployments have saved more than 3,000 hours of analyst time. The agentic security market is getting serious investment quickly. More than $315 million went into this category in just January and February of 2026. Gartner formally recognised AI security agents as a distinct category in 2025 and named them a top trend for the year ahead. Analysts predict that by the end of 2026, 30% or more of large enterprise security workflows will be executed by agents. There is a genuine risk worth naming. Gartner projects that by 2028, a quarter of enterprise breaches will be traced back to AI agent abuse, meaning attackers will find ways to manipulate or exploit the agents themselves. The same tools that speed up defence also create new attack surfaces. Any organisation deploying these agents needs to monitor what the agents actually do in production, not just what they were designed to do. For most non-technical business operators, the takeaway is this: the security staffing problem that has frustrated IT budgets for years is not going to be solved by adding headcount. The companies that contain costs and response times will be the ones that automate the repetitive first-pass work and redirect their people toward decisions that genuinely need human judgment. Salesforce is documenting that publicly, which is useful for anyone trying to make the same case internally.