The new capabilities enable security teams to investigate network access, generate policy recommendations and prepare coordinated changes through AI agents, while keeping approval authority with human practitioners.
FireMon has announced FireMon Agentic AI, a new set of capabilities designed to change how enterprises investigate network access, evaluate security policies and prepare network security changes.
Integrated into FireMon’s network security management solutions, the capabilities position AI agents as active participants alongside security practitioners. Agents can handle complex, multi-step tasks using existing policy data, operational context and tools that network security teams already rely on.
Organizations can use agents provided by FireMon, customize existing agents, develop their own or connect external agentic workflows through the FireMon MCP Server.
Network security teams increasingly manage policy decisions across multiple firewall vendors, cloud environments and segmentation technologies. A single business access request can involve several devices and policies, with multiple technically valid implementation options.
Engineers must collect relevant information, assess available approaches and coordinate proposed changes before they can be approved. As organizations demand faster responses, these manual processes consume specialist resources and slow down delivery.
FireMon Agentic AI is designed to reduce this workload by assigning investigation and planning activities to agents. They gather relevant evidence and prepare recommendations within their authorized scope, while practitioners direct the process and retain responsibility for decisions requiring organizational judgment.
“Network security has never been more complex, and the answer isn’t more infrastructure. It’s putting the policy context FireMon has built over 25 years to work,” said Jody Brazil, CEO of FireMon. “Customers can deploy our agents, build their own, and connect FireMon to their broader agentic workflows, while practitioners keep the calls that need human judgment.”
Putting Network Security Policy Intelligence to Work
Agents are central to FireMon’s Agentic AI approach. Each operates with assigned instructions, skills, tools and permissions, using the policy information and operational expertise available through FireMon’s Network Security Policy Control for the Modern Enterprise.
This foundation combines the context required to understand access requests with tools that support practical activities, including searching policy records, identifying traffic paths, calculating recommendations and preparing Policy Plan changes.
Organizations can adopt the capabilities through three approaches:
- Use FireMon-provided agents: Start with agents supplied as part of the platform.
- Customize or build agents: Adapt existing agents or create new ones within FireMon.
- Connect external workflows: Integrate external agentic processes through the Model Context Protocol (MCP).
These options allow organizations to determine which activities they want to automate and how the capabilities fit into their existing operational processes.
Automating Investigations and Preparing Policy Changes
FireMon’s supplied agents demonstrate how AI can reduce manual coordination in everyday network security operations. The company says the capabilities can save thousands of hours while improving the accuracy of network security policy decisions.
Key capabilities include:
- Investigating policies using natural-language requests: The FireMon Intelligent Agent searches and analyzes policy data, creates and executes Security Intelligence Query Language (SiQL) queries, and explains the results. Practitioners can ask which rules allow access to a particular service and review the relevant policy context without manually constructing queries.
- Converting business access requirements into recommendations: The Network Designer Agent examines access requests and generates firewall policy recommendations. For example, when an application requires HTTPS access to a reporting service, the agent identifies proposed policy changes for a practitioner to assess.
- Preparing coordinated changes across devices and policies: The Policy Change Designer Agent takes an access request through discovery and recommendation stages before preparing Policy Plan changes. It completes required details, such as rule names, and pauses when a practitioner needs to select between valid alternatives.
Proposed changes are not saved until they have been reviewed and accepted. Practitioners can discard a proposal or request modifications. Once accepted, the proposed work is saved within the workflow; it is not automatically deployed to firewalls.
This approach addresses the complexity of network policy decisions, where multiple rules may satisfy the same access requirement and technically valid object names may not align with an organization’s internal conventions.
FireMon combines policy context, agent instructions and specialized tools to prepare recommendations that account for these requirements while leaving important decisions with practitioners.
FireMon MCP Server Connects External AI Workflows
The FireMon MCP Server makes selected network security policy information and supported operations accessible to external AI agents.
For example, an incident investigation workflow can combine alert information with relevant FireMon policy evidence. Similarly, an access management workflow can identify applicable devices and policies, calculate recommendations and prepare proposed changes without requiring practitioners to manually collect and transfer information between systems.
MCP supports both information retrieval and change preparation. Authorized workflows can turn selected recommendations into staged Policy Plan changes and save them within the FireMon workflow.
External applications manage the interaction and interpret the results, while access remains governed through roles and credentials. This enables organizations to incorporate FireMon’s network security intelligence into broader agentic workflows.
Customer Control, Permissions and Human Oversight
FireMon allows organizations to configure agent instructions, assign skills and tools, and restrict permissions to designated device groups.
Customers can also select a supported large language model (LLM), including an approved model environment of their own.
AI functionality is optional and disabled by default. Access controls and audit trails support accountability, while practitioners retain authority at the decision and approval stages of supported workflows.
Through these capabilities, FireMon aims to help enterprises reduce manual policy investigation and coordination while maintaining organizational control over network access decisions and security changes.