AI Analyst investigates every vulnerability, exposure and misconfiguration, works out what it puts at risk, finds the fix and, once a human approves, pushes it. False positives close themselves. Real risks get fixed.
Scanners, cloud tools and code analysis produce findings faster than anyone can check them properly. Each one needs the same questions answered: is it real, can an attacker reach it, what does it expose, and who owns the fix. Nobody has time to ask them three thousand times, so findings get skimmed or left in the backlog.
Most tooling just sorts findings by severity. A person still has to investigate, work out the fix, find the owner and get the change made.
Every finding goes to AI Analyst before it reaches a human. It pulls the asset's context from the inventory, checks whether the issue is actually present and reachable, looks for a public exploit or active exploitation, correlates with every other layer (a leaked credential, an overpermissioned role, an exposed port) and checks whether the asset sits on a known attack path.
Then it does what an analyst would do next. It works out the impact, meaning what the asset holds and what an attacker could reach from it, and finds the remediation: the patch version, configuration change or key rotation, with the owner and what the change might break.
False positives close with the reasoning attached. For confirmed risks, AI Analyst prepares the fix and, where an integration allows it, pushes it once a human approves. Otherwise it hands your team a ticket with the change spelled out. Your team makes the decision instead of doing the legwork.
Vulnerabilities, exposures, misconfigurations and leaked credentials, each checked for whether it is real, reachable and exploitable, with asset context, cross-layer correlation and attack-path relevance. A finished investigation rather than another line in the backlog.
What the asset holds, who depends on it, which attack paths run through it and which compliance controls it touches, so every verdict comes with the stakes spelled out.
The specific fix for each confirmed finding: the patch version, configuration change or access revocation, with the owner and a note on what it might break.
Where an integration allows it, AI Analyst applies the fix itself once a human approves: a configuration change, a key rotation, a patch. Where it can't, the fix goes to the owner as a ticket with everything needed to make the change.
Every conclusion shows what was checked, found and ruled out, and every approval and change is logged. Disagree and that feedback tunes the model for your environment.
Which categories always need human review, who can approve which fixes, severity thresholds and escalation channels. Most teams start conservative and widen automation as the reasoning holds up.
AI Analyst operates over the same data model as everything else in Kervo AI, which gives it something to investigate with. When a finding lands on a host, it already knows what that host is, who can reach it, what changed, whether it is on a live attack path, and how similar findings were resolved before.
Nothing in your environment changes until someone approves it. Check the reasoning closely for the first few weeks, then less as it earns trust.
A standalone triage tool sees only the finding and the scanner output. It can classify but not investigate, because investigating means asking about the environment: is this asset reachable, is this credential valid, does it lead somewhere that matters. In Kervo AI those answers live on the same graph as the finding.
A scanner reports that an issue exists. AI Analyst checks whether it is real in your environment, whether an attacker can reach and exploit it and what it would expose, then works out the fix and, once you approve, pushes it.
Every verdict is explainable and auditable, and you configure which categories always require human review.
Only after a human approves. Investigation is read-only. Where an integration supports it, AI Analyst applies the approved fix itself. Otherwise it hands the change to your team as a ticket with everything needed to make it.
Essentials includes up to 500 a month. Professional and Enterprise are unlimited.
Bring a vulnerability or exposure from your environment and we'll run it end to end: investigation, impact, the fix and the approval step.
