Real-time endpoint data keeps AI-driven IT operations accurate, fast and under control
Every so often a flaw comes along that shows how fast the ground can shift under IT and security teams. PHP2Shell, a pair of critical flaws in PHP, was one of them. Details leaked before the planned disclosure, frontier AI helped researchers find the flaws, and PHP shipped fixes the next day. For many teams, though, the patch was the easy part. So what does it take to respond at that speed, and where should teams begin?
What does governed autonomous IT look like in practice?
Picture a loop. Software finds where a risk lives and ranks what matters most. It proposes a fix, then, inside limits people define, carries it out and checks that it worked. Routine, low-risk actions can run on their own. Higher-impact ones wait for a person to approve. A few are never handed over at all. Each step leaves a record that someone can review and reverse.
What challenges do IT and security teams face today?
Three problems keep coming up. The first is visibility. PHP2Shell reportedly sat undetected for more than a decade. For these two flaws, the fix was a version upgrade. The hard part was finding every copy of PHP, including copies bundled inside other software or extracted by hand onto Windows machines that never registered as installed applications. Then teams had to work out which copies the internet could reach and check for signs of earlier attack. An inventory built from a periodic snapshot can't answer those questions on the day they matter.
The second is tool-hopping. Answering "where does this run, and can the internet reach it?" often means pivoting across an asset inventory, a vulnerability scanner and an external attack surface tool, each with its own view. Every hop adds delay. Every console is another chance to disagree with the last.
The third is pace. Several security firms reported exploitation attempts before PHP released its fixes, and Cloudflare reported early attacks hours ahead of the patch. Frontier AI models helped find PHP2Shell, and in April Anthropic said its Claude Mythos Preview model had found thousands of previously unknown flaws across every major operating system and browser. With models like these in the picture, the old rhythm of disclose, patch and verify assumes a gap that keeps shrinking.
Put an AI agent on top of stale, fragmented data and these problems don't go away. They scale.
Why does real-time endpoint data make autonomy trustworthy?
Endpoints are where work happens and where many attacks end up, so they are the ground truth for any decision about the estate. Four qualities make that data a sound foundation for autonomous action:
-
Live data from the endpoints themselves, not a snapshot that was true last week.
-
A short path from question to action, with no hopping between tools to reconcile answers.
-
Approvals and an audit trail, plus the ability to roll back, so any automated action can be reviewed and reversed.
-
Shared truth: IT operations, security and the system of record working from one view, rather than arguing over whose data is right.
Matt Psencik, a threat research engineer at Tanium, put the visibility problem bluntly when PHP2Shell broke: "The installations that worry me most are the ones a security team doesn't know it owns."
How does AI fit in?
AI sits on both sides of this. It helped researchers find the PHP2Shell flaws, and attackers can use it to build exploits too. For defenders, AI works best as the operator and the interface: it takes a plain-language question, works out what to ask of the data, and proposes or carries out the next step. But it is only as good as the data it is grounded in. A fluent answer built on outdated information is still wrong, just more confidently so. Keeping people in the loop where stakes are high is what makes automation safe to expand.
What are the practical first steps?
Teams don't need to hand over the keys all at once. Start here:
-
Find every copy: Don't stop at the installed-applications list. PHP2Shell showed that software bundled inside other products can slip past it. Compare your CMDB against what is really on your network and record exact versions.
-
Draw the lines: Rank systems by what the internet can reach, then decide which response actions run automatically, which need approval and which are never delegated. Write it down before an agent needs it.
-
Pilot one low-risk workflow: Pick something contained, build approval into it, and read the audit trail before widening the scope.
Teams can also shorten the pilot with a partner. World Wide Technology (WWT), a Tanium partner, works with many large organizations on technology rollouts and hosts a Tanium lab in its Advanced Technology Center, where customers can test an approach hands-on before moving it into production.
That second problem, the hopping, is the one Tanium Atlas was built to close. Instead of moving between consoles, an operator asks a plain-language question, gets an answer from live endpoint data, and acts on it inside limits the team sets, with every action recorded. Want to see how it works in practice? Click here and set up time to see Tanium in action.
Sponsored by Tanium.