Continuous security enters the development cycle with agents
Development speed increases when tools and agents take part in building software. The same movement can increase the number of changes that need to be reviewed. The answer doesn't have to be a bigger final inspection. It can be taking verification to each change, with enough rules and context to separate signal from noise.
On September 18, Google Cloud published an account of agentic AI methods used to protect its infrastructure code. The team describes an architecture that combines pre-submit scanning, triage agents and agents that propose fixes for human review.
Context reduces noise
According to Google, the system examines each change in real time, uses threat models associated with the code and walks through dependencies to refine the analysis. The company reports a false positive rate of 3% in some cases and more than 92% precision for a triage agent that finishes the work in under a minute.
These numbers belong to Google's environment, data and processes. They're not an expectation for any team. The transferable principle is the design: up-to-date context, deterministic validation and specialized agents working in separate steps.
Fixing fast doesn't eliminate review
The method also proposes that an agent build a fix based on the evidence found and send it for human review as part of the original request. That shortens the time between discovering and solving, but keeps the responsibility for approving the change.
For an SMB, the risk lies in automating the fix without knowing which systems, dependencies or rules were considered. A quick suggestion can create a regression, break an integration or mask a bigger problem.
The same principle applies to automations outside development. An agent that changes a record, a document or a customer service flow also needs to operate with a defined scope, logging and review. The technology used to detect the problem may vary, but the responsibility still lies with the company that put the process into operation.
The decision for the company
The first step is choosing a small development or automation flow and defining four controls: which changes will be checked, what context the agent can access, which structural test validates the alert and who approves the fix.
Then measure triage time, false positives, time to fix and incidents after the change. If the agent doesn't improve these indicators without increasing rework, the design needs adjusting. Continuous security doesn't mean releasing fixes without supervision. It means making review earlier, more specific and closer to the real work.
Sources
Google Cloud, 18 Sep 2026. https://cloud.google.com/blog/topics/systems/using-ai-agents-to-secure-google-infrastructure/