Why it counts
IBM's 2024 data puts the average breach at 258 days to identify and contain. An agent incident gives a team about the length of a coffee break. A plan written for breaches assumes human-paced problems, so the team starts hunting for an intruder who isn't there.
Where teams get it wrong
The instinct in the first ten minutes is to find the cause. Containment beats understanding. Move the agent to advisory mode, then look for the why. The other mistake is silence. Saying "we're looking into it" beats saying nothing.
One example
A logistics company ran monthly drills on its routing agent. The third drill exposed a 45-second delay in the backup switch. They fixed it. The next week the agent hit an edge case and started sending every West Coast delivery through Denver. The team switched to manual routing in under 3 seconds. The impact was 12 confused drivers instead of 4,500, and the company kept a $2.3 million client.