Detection at Scale FanDuel's Tyler Martin on the Bronze-Silver-Gold Path to Autonomous Security Triage
Tyler Martin, Senior Director of Enterprise Security Engineering & Operations at FanDuel, reflects on revolutionizing security operations by replacing traditional analyst tiers with security engineers supported by custom AI agents. Tyler shares the architecture behind SAGE, FanDuel's phishing automation system, and explains how his team progressed from human-in-the-loop validation to fully autonomous triage through bronze-silver-gold maturity stages.
The conversation explores practical challenges like context enrichment, implementing user personas connected to IDP and HRIS systems, and choosing between RAG versus CAG models for knowledge augmentation. Tyler also discusses shifts in detection strategy, arguing for leaner detection catalogs with just-in-time, query-based rules over maintaining point-in-time codified detections that no longer address active risks.
Topics discussed:
- Restructuring security operations teams to include only security engineers while AI agents handle traditional level 1-3 triage work.
- Building Security Analysis and Guided Escalation, an AI-powered phishing automation system that reduced manual ticket volume.
- Implementing bronze-silver-gold maturity stages for AI triage: manual validation, automated closures with oversight, and full autonomous operations.
- Enriching AI agents with organizational context through connections to IDP systems, HRIS platforms, and user behavior analytics.
- Creating user personas that encode access patterns, permissions, security groups, and typical behaviors to improve AI decision-making accuracy.
- Designing incident response automation that spins up Slack channels, Zoom bridges, recordings, and comprehensive documentation through simple commands.
- Eliminating 90% of missing PIR action items through automated documentation capture and stakeholder tagging in Confluence.
- Shifting detection strategy from maintaining large MITRE-mapped catalogs to just-in-time query-based rules written by AI agents.
- Balancing signal volume and enrichment data against inference costs while avoiding context rot that degrades LLM performance.
- Evaluating RAG versus CAG models for knowledge augmentation and exploring multi-agent architectures with supervisory oversight layers.
Listen to more episodes: