Palantir’s product security team shared on a Medium blog its experience introducing agentic AI into security work.

The team has deployed AI agents for about a year across various security tasks including code review, vulnerability discovery and penetration testing. It is also offering the know-how to customers under the name Security Forge.

Palantir said its main points can be summarised into 5 categories.

First, it said a security review programme cannot be built with a single model. A model needs a “harness”. It defined a harness as the full set of software and rules that split work by agent, set access rights, preserve evidence and deliver results to engineers. Palantir uses its AIP platform as the harness.

Second, it said harness performance depends on organisational context. Accurate judgment requires giving the model information such as relationships between services, trust boundaries, deployment status, past review results and owner details. Palantir links that context through its data platform, Foundry.

Third, it said organisational context itself is competitiveness. Palantir stressed that such data and decision records must not be exposed externally. It said that if data flows to external model providers, an organisation’s own defensive capability does not improve and only the provider’s model gets smarter. Palantir also said it has completed a shift for all employees from clients of frontier model providers to in-house tools.

Fourth, it said remediation has become a bigger bottleneck than finding vulnerabilities. AI agents find vulnerabilities far faster than humans. The issue is how quickly those vulnerabilities can be fixed. Palantir applies validated fixes automatically across the entire system through its software deployment platform, Apollo.

Fifth, it said the real asset is not the model but the system around it. Models continue to improve. Without a system to record findings, preserve decision rationales and deploy fixes, organisations must start over each time they change models. Palantir said it maintains such a system by combining three platforms: Foundry, AIP and Apollo.

Palantir also presented an execution sequence that other organisations can refer to. It called for compiling a software inventory, starting with narrow-scope code reviews, putting controls around the model, comparing and evaluating multiple models, and accumulating decisions as organisational assets.