FireMon has announced FireMon Agentic AI, a set of capabilities designed to help enterprises investigate network access requests, assess policy options and prepare security changes.
The agents are built into the company’s network security management solutions and use policy data and tools available to practitioners. Customers can use FireMon’s agents, build or customise their own, or connect external workflows through the FireMon MCP Server.
Managing a growing volume of policy decisions
Network security teams must make policy decisions across firewall vendors, cloud environments and segmentation technologies. A single business access request may involve several devices and policies, with more than one technically valid way to implement it. Engineers need to gather relevant information, compare options and coordinate proposed changes before they can be approved. Manual work can slow delivery as demand for faster decisions grows.
FireMon Agentic AI is intended to handle investigation and planning tasks within an agent’s assigned scope. Agents gather evidence and prepare recommendations, while practitioners direct the work and make decisions that require organisational judgement. FireMon says this approach is designed to help teams manage policy complexity while keeping authority over access and changes with the organisation.
“Network security has never been more complex, and the answer isn’t more infrastructure. It’s putting the policy context FireMon has built over 25 years to work,” said Jody Brazil, founder and CEO of FireMon. "Customers can deploy our agents, build their own, and connect FireMon to their broader agentic workflows, while practitioners keep the calls that need human judgment.”
Investigating policies and preparing changes
FireMon agents operate with assigned instructions, skills, tools and permissions
FireMon agents operate with assigned instructions, skills, tools and permissions. They draw on policy information and operational expertise, with capabilities including searching policy records, identifying traffic paths, calculating recommendations and preparing Policy Plan changes.
The supplied FireMon Intelligent Agent can search and analyse policy data, create and run Security Intelligence Query Language (SiQL) queries, and explain its findings. Practitioners can ask which rules allow access to a service and review the relevant policy context without manually building a search.
The Network Designer Agent analyses business access requirements and produces firewall policy recommendations. For example, for an application requiring HTTPS access to a reporting service, it identifies possible policy changes for a practitioner to assess.
The Policy Change Designer Agent can take an access request through discovery and recommendations, then prepare Policy Plan changes. It fills in required details, such as rule names, and pauses when a practitioner must choose between valid options. Proposed work is not saved until it has been reviewed and accepted. Users can also discard a proposal or request revisions. Acceptance saves the changes to the workflow; it does not automatically deploy them to firewalls.
Connecting external agentic workflows
FireMon says the capabilities are intended to address the fact that multiple policies may meet an access requirement, while technically valid object names may not follow an organisation’s conventions. By combining policy context with agent instructions and specialist tools, the platform can prepare proposals for practitioners to review at key decision points.
FireMon says the capabilities are intended to address the fact that multiple policies
The FireMon MCP Server makes selected policy data and supported operations available to external agents. For example, an incident investigation workflow could combine alert information with FireMon policy evidence. An access workflow could identify relevant devices and policies, calculate recommendations and prepare changes without requiring practitioners to collect and transfer the information themselves.
Authorised external workflows can turn selected recommendations into staged Policy Plan changes and save them in the FireMon workflow. The external application directs the interaction and interprets the results, with access controlled through roles and credentials.
Permissions, models and availability
Customers can set agent instructions, assign skills and tools, and limit permissions to appropriate device groups. They can choose a supported large language model, including an approved model environment of their own. AI enablement is optional and off by default. Access controls and an audit trail support accountability, while practitioners retain authority at decision and approval points in the supported workflow.
FireMon Agentic AI and the FireMon MCP Server are scheduled to be available in November, with no additional FireMon charge for the initial offer. Further information is available through the company’s Agentic AI Launch Blog and launch webinar.
FireMon, the pioneer in network security policy management and the security policy control plane for the modern enterprise, announces FireMon Agentic AI, changing how enterprises investigate network access, make policy decisions, and prepare security changes.
Built into FireMon’s award-winning network security management solutions, the new agentic AI capabilities makes agents first-class citizens alongside practitioners, putting them to work on complex, multi-step tasks using the policy data, context, and tools practitioners already trust. Customers can use FireMon’s supplied agents, create their own, or connect external agentic workflows through the FireMon MCP Server.
Growing volume of policy decisions
Network security teams face a growing volume of policy decisions across firewall vendors, cloud environments, and segmentation technologies. A single business access request can span multiple devices and policies, with several technically valid ways to implement it. Engineers must gather the facts, evaluate the alternatives, and coordinate the proposed changes before anyone can approve them. As the business demands faster decisions, manual coordination consumes expertise and slows delivery.
FireMon Agentic AI changes that process. Agents carry out the investigation and planning steps, assemble relevant evidence, and prepare recommendations within their assigned scope. Practitioners direct the work and make the choices that require organizational judgment. The shift gives teams more capacity to address policy complexity and respond to business needs, while keeping authority over access and changes with the organization.
Discovering traffic paths
“Network security has never been more complex, and the answer isn’t more infrastructure. It’s putting the policy context FireMon has built over 25 years to work,” said Jody Brazil, founder and CEO of FireMon. "Customers can deploy our agents, build their own, and connect FireMon to their broader agentic workflows, while practitioners keep the calls that need human judgment.”
Agents are built at the center of FireMon’s Agentic AI approach. They operate with assigned instructions, skills, tools, and permissions, drawing on the policy information and operational expertise at the core of FireMon’s Network Security Policy Control for the Modern Enterprise. That foundation combines the context needed to understand a request with tools that perform the work, from searching policy records and discovering traffic paths to computing recommendations and preparing Policy Plan changes.
Customers can adapt FireMon Agentic AI into their own operations in three ways. They can start with supplied FireMon agents, customize those agents or build new ones inside FireMon, and connect external agentic workflows through Model Context Protocol (MCP). This puts customers in control of the work they automate and the way it fits their processes, with value that reaches beyond the initial agent examples.
Network security policy decisions
The agents supplied with the platform demonstrate how that foundation changes day-to-day network security work, saving thousands of hours of work while increasing accuracy of network security policy decisions.
Investigate policy without writing queries. The FireMon Intelligent Agent searches and analyses policy data, constructs and runs Security Intelligence Query Language (SiQL) queries, and explains the findings. Practitioners can ask which rules allow access to a service and examine the relevant policy context without manually assembling searches.
Turn business access needs into actionable recommendations. The Network Designer Agent analyses an access requirement and produces firewall policy recommendations. For an application that needs HTTPS access to a reporting service, it identifies recommended changes for the practitioner to evaluate, reducing the investigation required before deciding how to provide access.
Prepare coordinated changes across devices and policies. The Policy Change Designer Agent carries an access request through discovery, recommendations, and preparation of Policy Plan changes. It fills required fields such as rule names and pauses when a practitioner must choose among valid alternatives. Nothing is saved until review and acceptance; the user can discard the proposal or request revisions. Acceptance saves the proposed work for the workflow, rather than automatically deploying it to firewalls.
Combining alert information
These examples address a practical barrier to policy automation. More than one policy may satisfy an access request, and an object name that is technically valid may not fit the organization’s conventions. FireMon combines policy context, agent instructions, and specialized tools to prepare work that reflects those requirements and bring consequential choices to the practitioner.
The FireMon MCP Server makes selected policy data and supported operations available to external agents. An incident investigation workflow can combine alert information with FireMon policy evidence. An access workflow can discover relevant devices and policies, compute recommendations, and prepare changes without requiring a practitioner to gather and transfer the information manually.
Approved model environment
MCP supports both retrieval and change preparation. Authorized workflows can convert selected recommendations into staged Policy Plan changes and save them into the FireMon workflow. The external application directs the interaction and interprets the results, with access controlled through roles and credentials. This connects FireMon’s network security intelligence to the broader workflows customers are building.
Customers define agent instructions, assign skills and tools, and scope permissions to appropriate device groups. They can choose a supported large language model, including their own approved model environment. AI enablement is optional and off by default, with access controls and an audit trail supporting accountability. Practitioners retain authority at the decision and approval points in the supported workflow.
The FireMon agentic AI platform and FireMon MCP Server will be available in November. The initial offer carries no additional FireMon charge. For more information about FireMon’s agentic AI capabilities or to see the platform in action, visit FireMon’s Agentic AI Launch Blog. Customers can also sign up for our Agentic AI Platform launch webinar to learn about the new capabilities.
