What an AI agent should say during a security lockdown

In April 2025 NIST published Rev. 3 of its incident response guide, SP 800-61, replacing Rev. 2 from 2012. It’s laid out as a Community Profile of the Cybersecurity Framework 2.0, but there’s a paragraph on outside providers that I think every IT lead at a dealership should read before they put an AI agent anywhere near e-automate. NIST calls it a shared responsibility model and says the split should be written into the contract, including who has the authority to act on your behalf and any restrictions on what the provider can do on its own, such as “immediately deactivating certain services to contain an incident.” It also says plainly that service providers often have privileged access to your systems, and that the risk of the provider itself being compromised should be considered.

I’d count an AI agent that answers your customers and writes meter reads into e-automate as that kind of provider. So the question for the security review is what it does, and what it says to the customer on the phone, while you’re locking things down.

Two lockdowns worth planning for

The first is the one you start. Something looks wrong, maybe a phished account or an odd write in the audit log, and you want the agent out of e-automate now. The second is the one that happens to you: e-automate is offline because you took the server down, or the incident is somewhere else and the ERP is collateral. Those need different answers, and I’d ask a vendor about both separately, because an agent can be cut off from e-automate and still be talking to your customers.

When the agent can’t check the record

In my view an agent that can’t see e-automate should say only what it can still stand behind. It shouldn’t tell a customer their meter read posted, or quote a toner order status from whatever it remembered an hour ago, or confirm a service call time it can’t look up. The honest line is that the request has been taken and a person will confirm it.

That’s how we built Auralis for the case where e-automate is unreachable (our security and hosting one-pager covers the rest of the review). It keeps taking calls and emails, tells the customer a person will confirm, and queues the writes. When the system comes back, each queued action re-checks the record before it posts, so nothing gets written from a stale copy.

If Auralis is the thing that’s down, your phone number and inboxes fall back to your team the way they worked before, which means the agent doesn’t add a new single point of failure in front of customers during an incident that might have nothing to do with it.

When you pull the plug yourself

NIST defines containment as preventing the expansion of an incident, and it says most incidents need some form of it. One of its recommendations is to let incident handlers choose and run containment actions by hand, instead of or alongside automated ones. For an AI agent, the manual action should be one step that your own team can take without waiting on the vendor.

For Auralis, that step is revoking the service account. Auralis connects to e-automate as an ECI partner integration via the ESN API and runs under a service account you create, scoped to the objects you approve (contracts, meters, supplies, service calls, invoices, parts). Nothing is on by default. If you need to stop it, you revoke the service account and every read and write stops with it, without a call to us.

Once the account is revoked, Auralis sends what comes in to a human agent for review. With no read access it can’t look up a contract or a meter, so anything it said beyond that would be a guess. I’d still tell dispatch the agent has lost e-automate access, and decide before the incident who on the team reviews those requests.

Write the script down in advance

NIST sorts incident communication into four categories, and one of them is formally notifying affected customers, partners or regulators about a breach. Your agent shouldn’t be doing that part. It also recommends following established procedures for what gets reported to whom and when, starting with the first notification and running through regular status updates. The agent’s lines belong in that same document, next to the human ones:

1. What the agent says when e-automate is unreachable.
2. Who reviews the requests it hands over after the service account is revoked.
3. Who on your team is allowed to revoke it, and who tells dispatch.
4. Where the record of what it did lives. Auralis keeps a full audit log of every read, every write and every hand-off, with retention defaulting to 30 days. If your investigation process needs longer, set it to match your policy before you need the log.

After containment, NIST’s eradication step can include disabling breached user accounts, and I don’t see how you decide which ones without a record of what each account touched.

If you’d like to go through this on your own setup, book a 30-minute walkthrough with your IT lead on access, hosting and the audit log: auralis.ai/demo/.

Sources

• Alexander Nelson, Sanjay Rekhi, Murugiah Souppaya and Karen Scarfone, SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, NIST, April 2025.
• Auralis product information (internal).