# How Agentforce-Powered AI Security Workflows Accelerate Incident Response

[Salesforce](https://yomu.fyi/company/salesforce) · Scott Nyberg · Aug 12, 2026

**Type:** Explainer

## Summary

Salesforce engineers expanded Security Center from a basic conversational interface into an Agentforce-powered stateful investigations platform for incident response. Managing enterprise security incidents required handling long-running lifecycles, disparate telemetry formats, and finite LLM context windows that risk reasoning pocket collapse. To prevent overflowing context limits, the architecture partitions telemetry into contextual segments and uses AI-driven summarization pipelines before feeding data to the agent. Because non-deterministic LLM outputs break traditional deterministic testing, the team implemented AI-driven evaluation pipelines using simulated customer interactions to evaluate response behavior rather than exact wording. Ongoing work focuses on grounding public foundation models with curated, Salesforce-owned security knowledge to improve platform-specific remediation guidance.

## Context

Salesforce environments introduce unique operational and telemetry challenges that traditional tooling struggles to address, while real security incident response requires long-running operational management rather than transient conversational AI chats.

## Approach / What changed

Salesforce built a stateful investigations platform featuring extensible data models, AI-driven summarization pipelines to compress segmented telemetry within context windows, structured action routing, and an AI-driven evaluation framework using simulated interactions.

## Takeaways

- AI-driven evaluation pipelines using LLM evaluators to assess behavior rather than exact wording increased testing throughput by approximately 10–20X.
- Partitioning telemetry into contextual segments and summarizing investigation state prevented raw data from exceeding finite LLM context windows.
- Extensible data models allow the platform to aggregate diverse telemetry formats across threat categories without coupling the architecture to specific types.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Incident Response](https://yomu.fyi/topic/incident-response), [LLMs](https://yomu.fyi/topic/llm), [Testing](https://yomu.fyi/topic/testing)

[Read original post](https://engineering.salesforce.com/how-agentforce-powered-ai-security-workflows-accelerate-incident-response)