Cybersecurity and AI security

Specialist agents · 25

• Exposure inventoryproposal

  Maintains the asset inventory (domains, servers, SaaS, endpoints, APIs) and cross-checks it against what is reachable from the internet to detect unregistered exposed surface, forgotten services or unnecessary open ports. Proposes scanner configuration changes to cover new assets.

• Vulnerability watchanalysis

  Prioritizes vulnerability scanner findings by combining severity, exploitability, asset exposure and business criticality, and flags what to fix first and by when. Detects aged findings that breach internal patching deadlines.

• Permission reviewproposal

  Reviews accounts, roles and permissions in the identity system to detect excessive privileges, inactive or orphaned accounts, missing MFA and access creep after role changes. Proposes permission removal or reduction for Security approval.

• Secrets protectionproposal

  Detects credentials, API keys and tokens exposed in repositories, documents, emails or AI traces and prepares the rotation and revocation plan ordered by criticality and dependencies. Does not execute rotation: proposes it for authorization.

• Software reviewanalysis

  Checks software dependencies, versions, licenses and recent changes in code or third-party packages to detect vulnerable, abandoned or supply-chain-risk components. Reports the impact of each relevant change.

• Security monitoringproposal

  Classifies SIEM alerts by severity and type, groups related events, attaches evidence and filters recurring noise. Proposes detection rule tuning to cut false positives without losing coverage.

• Incident responseproposal

  Prepares the containment, eradication and escalation plan when an alert is confirmed as an incident: isolation, access revocation, internal communications and timelines. Assesses whether legal notification applies and leaves the decision to Security.

• AI agent securityproposal

  Assesses the security of AI agents: resistance to prompt injection, tool scope and granted permissions, and data leakage risk in inputs and outputs. Proposes tool or access restrictions for each agent.

• Model evaluationanalysis

  Designs and runs model evaluations with defined test cases (safety, bias, robustness, leakage) and compares results across versions to detect behavioral regressions before wider use.

• Security awarenessanalysis

  Prepares security training programs and authorized simulations (e.g. phishing) tailored to roles and recent incidents, and measures employee response. Only proposes simulations with prior Security approval.

• Application securityproposal

  Analyzes in-house code and applications with SAST/DAST and the OWASP Top 10, prioritizes findings by exploitability and proposes scanner adjustments to embed secure-development controls in the delivery cycle.

• Cloud securityproposal

  Reviews cloud and SaaS configuration (public storage, excessive roles, disabled logging), detects drift from the baseline posture and proposes configuration and permission remediations.

• Endpoint and network securityanalysis

  Monitors EDR and MDM coverage, device encryption, network segmentation and network access under a zero trust approach, and flags unmanaged or non-compliant devices.

• Email security and anti-fraudproposal

  Watches SPF, DKIM and DMARC configuration and detects CEO fraud, impersonation and bank account change requests, proposing detection adjustments in the SIEM.

• Threat intelligenceproposal

  Tracks external threats relevant to the company's sector and tech stack, leaked credentials and dark web mentions, and turns them into prioritized actions.

• Breach notificationanalysis

  Determines breach notification obligations by jurisdiction (GDPR, NIS2, US state laws) and drafts communications to authorities, customers and affected individuals within deadlines.

• Resilience and backupanalysis

  Verifies immutable backups, restore test execution and the currency of continuity and ransomware recovery plans, and flags RPO and RTO gaps.

• Data protection and DLPproposal

  Classifies sensitive data, reviews encryption at rest and in transit and detects information leaks, including data sent to AI tools, proposing prevention rules in the SIEM and AI traces.

• AI red teamingproposal

  Designs authorized adversarial attacks (prompt injection, jailbreak, tool-based exfiltration) against in-house models and agents, defines scope and success criteria and proposes test cases on AI traces.

• AI governanceproposal

  Maintains the inventory of AI uses, classifies them by risk under the AI Act and NIST AI RMF and detects unauthorized shadow AI.

• Penetration testingproposal

  Plans and scopes authorized pentests (scope, windows, rules of engagement), coordinates execution with the provider and verifies remediation of findings.

• Compliance and certificationsanalysis

  Prepares and maintains the controls and evidence required by SOC 2, ISO 27001, ENS, NIS2 and other applicable frameworks, detecting controls without current evidence ahead of audits.

• Customer trustanalysis

  Answers customer security questionnaires, maintains the trust center and prepares the data room security section with consistent, verified information.

• Vendor riskanalysis

  Assesses the security of vendors and SaaS and AI services before contracting and throughout the relationship, reviewing certifications, data handling and subprocessors.

• Risk, policy and reportinganalysis

  Maintains the security risk register, policies, periodic management reporting and cyber insurance management (renewal and coverage requirements).