AI Analyst does the work of a security analyst on every finding: it investigates, works out the impact, finds the fix and pushes it once a human approves. Guided remediation covers everything Evaluate ranked.
Two things eat a security team's week. Triage: findings arrive faster than anyone can check them, so they get skimmed. And remediation gruntwork: someone still has to work out the actual fix, who owns the system and what it might break.
Most tooling just sorts findings by severity. A person still does the investigation.
Every finding goes to AI Analyst before a human. It pulls asset context from the inventory, checks whether the issue is real and reachable, correlates signals across every other layer and checks for a known attack path. Then it works out the impact, finds the fix and reaches a verdict: a false positive closed with reasoning, or a confirmed risk with the fix ready for a human to approve.
Every finding Evaluate ranked comes with the specific change, the systems affected, the controls satisfied and the attack paths collapsed. "Close four paths to your customer database" beats "severity high".
The work of a security analyst on every finding: is it real, can an attacker reach it, what does it put at risk, and what is the fix. Where an integration allows, AI Analyst pushes the fix once a human approves. Your analysts start at the decision.
The specific fix for every ranked finding, with affected systems, compliance controls touched, attack paths collapsed and a sense of what it might break. Findings route straight into your ticketing system with that context attached.
Fixes that need a person to approve, not to carry out: rotate a key when a credential surfaces, apply a configuration change, open a ticket with the owner. Nothing runs without approval unless you choose to automate a category. The default is conservative.
Every path and finding carries a score that updates as fixes land, so you can see which remediation moved the number. A trend line from real data instead of a count of closed tickets.
AI Analyst runs on the same data model as everything else in Kervo AI, which gives it something to investigate with. When a finding lands on a host, it already knows what that host is, who can reach it, what changed, whether it is on a live attack path, and how similar findings were resolved before.
Verdicts are explainable by design: what was checked, what was found, what was ruled out and why. Disagree, and that feedback tunes the model for your environment.
Resolve closes the issue. It does not prove it stayed closed, or that your controls are working. Validate does that: controls checked continuously, evidence collected automatically, drift caught before an auditor finds it.
A scanner reports that an issue exists. AI Analyst checks whether it is real in your environment, whether an attacker can reach and exploit it and what it would expose, then works out the fix and, once you approve, pushes it.
Every verdict is explainable and auditable, and you configure which categories always require human review. Most teams start conservative and widen automation as the reasoning holds up.
Only after a human approves, fix by fix, unless you choose to automate a category. Discovery and analysis are read-only throughout.
Findings on vendor infrastructure route to your vendor risk workflow with the evidence needed to raise them, rather than into your patch queue.
Bring a vulnerability or exposure from your environment and we'll run it end to end: investigation, impact, the fix and the approval step.
