AI use-case risk assessment
Worked example: Autonomous incident-response agent (SOC) · ARA-261031-079D53 · 2026-10-31 06:37:15 UTC · Agentic Risk Analyst v3.2.1 · Worked example: prepared in advance, not generated live
EXECUTIVE DECISION
ESCALATE TO RISK COMMITTEE
Inherent Critical → residual Medium
Scenario
A financial-services CISO proposes an autonomous SOC agent that can isolate endpoints, reset credentials, disable user accounts and block IPs in response to detections from the SIEM without human approval, in order to reduce mean time to contain. The agent uses an LLM to reason over alerts plus tool-calling to invoke EDR and IAM APIs.
Executive narrative
Full autonomy over account and endpoint actions is a board-level operational risk. Escalate with a tiered design.
Top risks
- Agent disables critical accounts or servers
- Attacker triggers the agent against the organisation
Conditions
- Tiered autonomy defined in an operating envelope
- Protected asset list and tested kill switch
Remediation plan
| Horizon | ID | Action | Owner | Priority |
|---|
| 0-30 days | A-01 | Define the operating envelope and protected assets | CISO | Critical |
| 30-90 days | A-02 | Pilot in recommend-only mode and measure false positives | SOC Manager | High |
Risk register
| ID | Risk | L | I | Inherent |
|---|
| R-01 | Agent disables critical accounts or servers | Likely | Severe | Critical |
| R-02 | Attacker triggers the agent against the organisation | Possible | Severe | Critical |
| R-03 | No audit trail of agent reasoning | Possible | Moderate | Medium |
Regulatory findings
Evidence status: model knowledge only; verify against source texts.
| Regulation | Applicability | Why it matters |
|---|
| APRA CPS 234 Information Security (Australia) | potentially applicable | Applies to APRA-regulated entities; incident response is in scope. |
| APRA CPS 230 Operational Risk Management (Australia) | potentially applicable | Agent errors could disrupt critical operations. |
Security threats
| ID | Threat | Inherent | MITRE |
|---|
| T-01 | Alert injection steering agent actions | Critical | OWASP LLM01:2025; LLM06:2025 |
| T-02 | Compromise of agent credentials | High | MITRE ATT&CK T1078 |
Controls and residual risk
| ID | Control | Priority | Addresses |
|---|
| C-01 | Operating envelope with tiered autonomy | Immediate | R-01, R-02 |
| C-02 | Protected asset list and kill switch | Immediate | R-01, R-02 |
| C-03 | Action and reasoning audit log | Near-term | R-03 |
| Risk | Inherent | Residual | Justification |
|---|
| R-01 Agent disables critical accounts or servers | Critical | Medium | High-impact actions need approval. |
| R-02 Attacker triggers the agent against the organisation | Critical | Medium | Envelope limits damage. |
| R-03 No audit trail of agent reasoning | Medium | Low | Full logging. |
Red team (resilience Low)
| ID | Test | Result |
|---|
| AT-01 | Injected instruction in alert | Partially Blocked |
| AT-02 | Alert flood | Vulnerable |
Decision support only, not legal or regulatory advice. AI-generated ratings and citations must be reviewed by a qualified person before they are relied on.