The Security Assistant is a chat window that sits on top of your own SITEY deployment. You ask a question in plain language, “which critical findings on 10.0.4.0/24 still have no owner?”, “write me a diagnostic for this CVE on that host?”, “why did this patch job fail?”: and it answers using your live database, not a generic model’s memory. It has 51 typed tools: most of them read your vulnerabilities, agents, scans, tasks and patch queue; 18 of them change something, and every one of those stops and waits for you to press Approve.
The problem
An analyst who wants to understand one finding usually ends up in four screens: the vulnerability record, the asset it belongs to, the scan that produced it, and the patch queue. Then they open a terminal and hand-write a PowerShell or bash check, guessing the right shell for the target OS. If they paste the finding into a general-purpose chatbot to get help, that chatbot cannot see the host, the CVSS score, the triage verdict, or whether an agent is even installed, so it answers in generalities and the analyst still does the work by hand.
Worse, the knowledge stays personal. The one engineer who knows how your estate reacts to a given hardening change is the bottleneck for everyone else. And the moment you let an AI act on infrastructure without a gate, one confidently wrong script on the wrong 300 machines undoes any time you saved.
How it works
- You open the conversation from whatever you were looking at
Chat is reachable on its own, but it is more useful when launched in context. Vulnerability detail, scan detail, patch job detail, agent detail, triage detail and scan access-problem pages all open a conversation bound to that record. When the conversation is bound to a vulnerability, the assistant is handed the vulnerability ID, name, CVE, target IP, port and service, CVSS, status, the bound agent’s hostname, IP and OS, the correct script language for that OS (bash or PowerShell), and the most recent triage score, false-positive probability and recommendation. It starts the conversation already knowing the case.
- The question is routed and grounded before the model sees it
An intent router classifies the message and picks the model tier, temperature, output budget and reasoning effort to match, so a headcount question does not cost what a strategy question costs. Your own preference overrides the router if you set one.
GreetingSimple lookupRemediationRisk assessmentTrendComplianceThreat intelIncidentExecutive reportRelevant context sections are selected rather than dumped, a retrieval step can pull matching knowledge chunks once you have built the knowledge index, cross-conversation memory recalls entities and decisions you discussed before, and a token-budget pass trims the prompt to fit the model’s context window.
- It reads before it answers
Read-only tools cover the product: list and inspect scans, analyze a completed scan, pull an agent’s full inventory snapshot, search agents, list discovered hosts, check reachability problems for a host, list tasks, groups, notifications and integrations, read dashboard statistics, look up a CVE, and check exploit availability. These run freely, because none of them change anything.
- Anything that changes state stops at an approval card
Eighteen tools are gated. When the model calls one, it is not executed, the stream emits an approval event and the UI renders a card naming the tool, its risk level and what it would do. The assistant is told to summarize its intent and wait. Only when you click Approve is the request re-sent with that specific tool marked approved.
Action Risk Queue a remediation script job for an endpoint, or for an explicit list of endpoints High Create or bulk-create patch jobs, or turn a triage result into a patch job High Create a remediation plan High Propose a batch rollback, or bulk-apply a learned script High Approve a patch job High, and role-gated Queue a read-only diagnostic script job for an endpoint Medium Change a vulnerability’s status, or email a vendor Medium Generate a rollback script Medium Create tasks in bulk Medium Reject a patch job Medium, and role-gated Create or assign a task, update a task’s status Low Re-run a reachability probe for a host Low LimitationApproval and authority are deliberately separate. The approval flag comes from the browser, so it only ever means “the user said yes.” It can never mean “the user is allowed.” Approving a script tool in chat does not send anything to a host either, it creates the diagnostic, remediation or patch job in a pending-approval state, and releasing that job to the agent is a second decision.
Approving or rejecting a patch job from chat is checked again on the server against the same role list that guards the HTTP endpoints, which ships as admin only, and if the role cannot be read the check fails closed. Bulk remediation requires an explicit list of agent UUIDs; fleet-wide targeting such as “all Windows machines” is disabled, and a server-side ceiling on target count aborts the whole batch rather than creating jobs for part of it. That ceiling defaults to a single agent, so wider batches are something an operator opts into by raising it.
- Multi-step work becomes a tracked workflow
For a real fix, the assistant proposes a diagnostic, you run it, it analyzes the output, then it proposes either a false-positive mark or a remediation, and finally a verification. Each of those phases is a state in a workflow machine attached to the conversation, with its own job or batch ID and its own approve button, and the endpoints behind those buttons require the patch approver role. A conversation that started as a question ends as an auditable chain of jobs instead of a wall of text.
What you can do
Get answers built from your database, with real IPs, CVEs and counts rather than invented numbers.
Written for the correct shell for the target host, checked against a safety validator before anything is queued.
Kick off single or batch triage and watch batch progress. Turning a triage result into a patch job is one of the approval-gated steps.
Type /durum for status, /onayla to approve, /reddet <reason> to reject, /tekrar-dene to requeue, /payload-düzenle key=value to edit an allowed payload key, and /iptal to cancel. Editing the payload invalidates any prior approval, so a changed job cannot ride an old sign-off.
Ask for a rollback script when a change behaved badly. The assistant also watches for negative feedback in your wording and offers one.
Create and assign tasks, spread a batch of tasks across several named assignees, and update statuses.
Reuse an existing script instead of generating a new one, when a matching one exists. That library builds itself from diagnostic, remediation and verification jobs that completed successfully.
With an explicit trigger phrase, it drafts a numbered plan, you approve the steps, and it executes within a ceiling of eight steps.
Conversations are private to their owner, auto-titled from the first message, and can be renamed, archived or deleted.
Who it is for
Want a second opinion on a finding without leaving it.
Would rather review a generated script than write one from scratch at 2am.
Running the patch queue, who need to approve, reject, requeue or cancel jobs with the reasoning attached.
Asking portfolio questions. Where the exposure is concentrated, how the trend moved, which SLAs are slipping.
Need a written rationale for why a finding was closed, marked false positive, or accepted.
Why it matters
The expensive part of vulnerability work is not the fix, it is the context assembly before the fix.
That means finding the host, confirming the finding is real, choosing the right command for that OS, and convincing someone it is safe to run. The assistant collapses that into one conversation that already holds the record, the asset and the triage verdict.
It also makes AI action safe enough to actually enable.
Nothing the assistant proposes reaches an endpoint by itself. The script tools queue a job in a pending-approval state, and dispatching it, whether from the patch queue or from a workflow phase button, requires the patch approver role, which ships as admin only. So you can put this in front of a junior analyst, and the worst case is a queued job that an admin still has to read before anything runs.
And because each question is routed to an appropriately sized model, with per-request token counts recorded and priced against a built-in rate table, you get a running estimate of spend instead of an unexplained bill.
Works with
The assistant is the conversational front end for several modules and calls straight into them: AI Triage for single and batch triage and false-positive verdicts, Patch Management for creating, approving and requeuing jobs, AI Remediation for script generation and the diagnose-fix-verify loop, Approval Gates for the human checkpoints described above, and AI Usage Analytics for the token and cost record behind every answer.
Frequently asked questions
Can it change things on its own?
No. Eighteen tools change state, and all of them are blocked at the moment of the call until you approve that specific tool. Approval is also not the same as authority. Anything that would reach an endpoint is created as a pending job rather than dispatched, and releasing it, like approving or rejecting a patch job from chat, is re-checked on the server against your role, which ships as admin only. If the role cannot be read the check fails closed, and the assistant is instructed to tell you plainly rather than to reach the same outcome by another route.
Which AI model does it use, and does my data leave my servers?
The model, API key and endpoint are configured in your own installation. It speaks the OpenAI API and the base URL is configurable, so you can point it at OpenAI or at an OpenAI-compatible provider. Your vulnerability database, scans and agents stay on your infrastructure; the prompts and context for each question go to whichever endpoint you configured, so if that endpoint is a hosted service, the question and the context assembled for it leave your network. Without a configured key the chat reports that AI is unavailable rather than failing silently.
What stops it from writing a dangerous script?
Generated scripts pass a validator before anything is queued. It blocks disk formatting and partition operations, registry key deletion and hive loading, stopping or reconfiguring security and EDR services, event log clearing, boot configuration edits and system reboots, and it enforces size limits on diagnostic and remediation scripts. Diagnostics are constrained to read-only commands and must carry an explicit true-positive, false-positive or inconclusive verdict line, on both PowerShell and bash targets.
Can it be tricked by text inside a scan result?
Untrusted text such as scanner descriptions and diagnostic output is sanitized before it reaches the prompt. Known instruction-override, role-hijack, delimiter-injection, prompt-leak and exfiltration patterns are filtered out, control characters are stripped and over-long input is truncated.
The Security Assistant ships inside SITEY. There is no separate AI add-on to license. You install the platform in your own environment, point it at your model endpoint, and start asking. See pricing for the full package.