Cohere's Security AI Agent: Combining North and Wiz

Cohere has used its enterprise AI agent platform North to automate incident response (IR) workflows integrated with the cloud security platform Wiz. Previously, when a security threat was discovered, tasks such as asset investigation, ticket creation, and report writing took 30 minutes to 2 hours per person, but an AI agent now handles this instead.

This solution was built through an MCP (Model Context Protocol) server. The Python-based MCP server converts Wiz's capabilities into 8 core tools (listing issues, searching vulnerabilities, querying assets, checking compliance status, etc.) and provides them to North.

The built agent performs the following automated workflows.

• Risk Analysis: Analyzes Wiz's 'Toxic Combination' to identify attack paths, and prioritizes based on actual Blast Radius by considering internet exposure and permission levels.
• Incident Response Automation: Executes everything from threat detection to ticket creation, Wiz status updates, and IR report drafting with a single prompt.