There are four basic premises of security. First protect, then detect an intrusion, then confine the scope of the intrusions, and then repair the environment to a known secure state.
Automated software security agents monitor the system to providing the protection of information, the detection of a breech of a security mechanism, the confinement of the breech to a small a footprint as possible, and the repair of breech brining the security system back to a secure known state.