Aegis: a security triage agent that remembers human analyst decisions, not just events

Healthy_Baseball_440 · reddit · 2026-09-28

A Reddit writeup details Aegis, a memory-powered account takeover triage agent:

Problem: Security teams face thousands of auth alerts (failed-login bursts, unfamiliar networks, new devices); most systems treat each as new.
Key design: Instead of just asking "does this look suspicious?", Aegis asks "have we seen this before, and what did a human conclude?" Using Hindsight as its memory layer, it trusts only confirmed analyst decisions — similarity alone isn't evidence. Loop: alert → investigation → human decision → memory → better future investigations.
Honest memory: Recalled records are grouped into patterns (credential stuffing, impossible travel, etc.); "unlinked records" lacking case IDs are surfaced explicitly, showing the quality of the memory rather than hiding gaps.
No bare similarity scores: Instead of "92% similar", it explains why a recalled case matters — same account, matching failed-login pattern, prior benign verdict, no containment taken. E.g., 22 failed logins followed by success looks alarming until a prior benign ruling on the same account is recalled.

More from coding & agent