Governance & Risk · App 13
Run IT and security on the same record as your people
Joiners, movers and leavers drive access and device work as governed Actions. Alerts, access reviews, devices and deployments share one policy engine and one audit trail.
The IT, device, security-hygiene and engineering-visibility layer of the business OS: every request, device, alert, access right and deployment lives on the same data as the people and operations it serves, and governed IT Digital Employees do the routine work with results measured in the Investment & ROI Ledger.
What IT & Security is
Mid-market IT teams typically run a service desk, a separate MDM, a spreadsheet for access reviews, a scanner console, a Git host and an HR system that emails them when someone joins or leaves. Every hand-off is a manual step and a gap in the audit trail. IT & Security is designed to close those gaps with four modules: ITSM (core), Device Management, Security Center and DevHub, all planned for W4 (Year 3).
People events drive IT work
One3 already holds the employee record (People), the identity (Identity & Access), files, approvals and the audit chain. When People marks someone as a joiner, mover or leaver, ITSM starts a runbook with account, group, device, asset and licence tasks as Actions, not emails. A leaver runbook closes only when revocation evidence is recorded.
One Action layer across IT and security
A security alert on a device can open an IT incident, propose a quarantine and start an access review for the device owner, under one policy engine and one hash-chained audit trail. ITSM reuses the Service Desk ticket, SLA and queue engine instead of building a second one. Production deployments in DevHub create change records in ITSM, and incidents link back to the deployment that caused them.
Agents act inside risk tiers
The AI IT Helpdesk Agent resets passwords after identity verification and routes access requests within policy. Device lock and access grants need approval unless autonomy has been earned. Remote wipe, work-profile removal and CERT-In report submission are R4: they always need a human approver who is not the requester, plus a second factor. Content from alerts, tickets, emails and repositories is treated as untrusted, so an agent reading it cannot plan a high-risk Action without human approval.
Integrate, do not rebuild
One3 does not build a SIEM, an EDR agent, a code scanner, a PAM vault or a cloud posture scanner. You keep the tools you run — Wazuh, Defender, CrowdStrike, Qualys or Tenable, GitHub Advanced Security — and Security Center ingests their alerts and findings, enriches them with employee, device and CI context, and turns them into owned, SLA-tracked work.
Measured outcomes
Ticket deflection, time to resolve, licences reclaimed and change failure rate are computed against per-tenant baselines frozen in the ROI Ledger, never quoted from vendor marketing.
India-first
India data residency for India tenants, WhatsApp as an employee IT channel, and CERT-In and DPDP workflow templates are planned. Each regulatory item must be verified with counsel.
Problems solved
What IT & Security fixes
IT requests arrive everywhere and half are never logged
Employees email, call and WhatsApp IT. Planned fix: portal, email, Slack, Teams and WhatsApp intake into one record, with an L1 agent answering from Knowledge.
Password resets and access requests eat the day
Repetitive requests handled by hand. Planned fix: an IT Helpdesk Digital Employee runs identity-verified resets and routes access requests to the resource owner for approval.
Joiners wait for laptops and leavers keep access
HR and IT are not connected. Planned fix: People events create joiner, mover and leaver runbooks with access, device and asset tasks and recorded revocation evidence.
Changes break production and nobody knows which one
Change records are detached from deployments. Planned fix: change records created from deployments, AI change risk scoring and deployment-to-incident linkage.
Device inventory is unknown and lost phones become crises
Inventory is spread across MDM and spreadsheets. Planned fix: device inventory linked to the employee and CI, plus a lost-device workflow with lock, approved wipe and breach handoff.
Security alerts pile up in three consoles
Alerts are not correlated with assets and owners. Planned fix: ingestion, dedupe, enrichment with device, user and CI context, AI triage and playbook Actions.
Access reviews are built in spreadsheets
Access data sits across the IdP and SaaS apps. Planned fix: review campaigns with AI recommendations, reviewer attestations, revocation Actions and evidence export.
Reportable incidents have unclear clocks and formats
Regulatory timelines are not in the tooling. Planned fix: CERT-In classification with a countdown and report draft, and DPDP breach handoff to Privacy Ops (verify).
Key capabilities
What you can do
Joiner, mover and leaver runbooks
People events trigger account, device, asset and licence tasks, with revocation evidence before a leaver runbook closes.
ITSM on the Desk engine
Incidents, requests, problems, changes, catalog and CMDB-lite reuse the Service Desk ticket, SLA and queue engine.
Verified password reset
The L1 agent verifies identity before sending a reset link, with every step written to the audit trail.
Devices tied to people and tickets
Native Android Enterprise and Intune connector, kiosk mode for POS, remote actions from the ticket and a governed lost-device flow.
Alerts with context
Alerts from Wazuh, Microsoft, Google and others normalised, deduplicated and enriched with owner, device and identity context.
Access reviews with evidence
Campaigns over One3 Identity and connected apps, AI recommendations, revocation Actions and hash-sealed evidence packs.
CERT-In clock and breach handoff
Reportable incident classification with a countdown, report draft and a personal-data breach handoff to Privacy Ops (verify).
Deployments linked to changes and incidents
Production deployments create ITSM changes, and new incidents suggest the causal deployment for a human to confirm.
R4 Actions always human
Wipe, work-profile removal and regulatory submission need an approver who is not the requester plus a second factor.
Modules
4 modules, one data model
Core modules come with the app. Add-ons switch on when you need them. Some modules can be bought on their own.
ITSM
Incidents, requests, problems, changes and CMDB-lite on the Service Desk engine
ExploreDevice Management
Device inventory, enrolment, kiosk mode, compliance and governed remote actions
ExploreSecurity Center
Alert triage, incidents, vulnerabilities and access reviews with context and evidence
ExploreDevHub
Repositories, PRs, pipelines and deployments linked to changes, incidents and metrics
ExploreWorkflows
How the work flows
End-to-end workflows inside the app and across One3.
IT incident to resolution
A message on any channel is identified, triaged by the L1 agent, answered or routed, and linked to a problem if it recurs.
- 1.Employee writes on the portal, email, WhatsApp, Slack or Teams
- 2.Employee is identified through a verified contact point
- 3.L1 IT agent proposes category, priority and configuration item
- 4.High-confidence known errors or Knowledge answers are given with citations or an allowed Action
- 5.Otherwise the incident routes to an assignment group with a handoff note
- + 3 more steps →
Joiner and leaver runbooks
People events start runbooks that provision or revoke accounts, devices, assets and licences with evidence.
- 1.People records a joiner, mover or leaver event
- 2.Runbook is selected by department, role and location
- 3.Joiners get accounts and groups, a device and enrolment invite, assets and licences, with a readiness check before start
- 4.Leavers are revoked immediately or scheduled at the exit time
- 5.Accounts are disabled, sessions revoked and privileged groups removed
- + 2 more steps →
Lost or stolen device
A reported loss locks the device, assesses data sensitivity and routes any wipe to a human approver with a second factor.
- 1.Employee reports the device stolen, for example on WhatsApp
- 2.Lost mode and lock are applied, pre-authorised for the owner's report
- 3.Data sensitivity is assessed from device groups and apps
- 4.Wipe proposal with reason and legal basis goes to the Approvals Inbox
- 5.IT manager approves with a second factor and the wipe command is confirmed
- + 2 more steps →
Alert to incident with CERT-In clock
Alerts are triaged, declared as incidents where needed, contained through approved playbooks and reported on time.
- 1.Alert arrives from a connector and is normalised, deduplicated and enriched
- 2.AI triage proposes severity and disposition
- 3.Analyst closes false positives with a reason or declares a security incident
- 4.If reportable under the configured CERT-In list, the reporting clock starts and a report is drafted
- 5.Playbook containment Actions run with approvals
- + 2 more steps →
Deployment to change to incident
Production deployments pass freeze and approval gates, create change records, and are linked to incidents they cause.
- 1.Pull request is merged and the pipeline runs
- 2.Production deployments check freeze windows and approval requirements
- 3.Approvals Inbox shows the risk score and PR summary
- 4.Deployment is recorded and an ITSM change is created or linked
- 5.During the monitoring window, a new incident suggests the causal deployment
- + 1 more steps →
AI inside
AI skills that act through governed Actions
Every AI skill runs through the same typed Actions people use, with risk tiers, approvals and an audit trail.
L1 IT triage and answers A3
Answers how-to questions from Knowledge with citations, collects missing details and proposes category, priority and CI.
Verified password reset and access routing A3
Runs identity verification before a reset and routes access requests to the resource owner.
Change risk scoring A2
Scores changes with factor explanations: CI criticality, dependency fan-out, historic failure rate, change size, window and backout plan quality.
Alert triage A3
Proposes severity and disposition with rationale citing alert and enrichment fields and a suggested playbook.
Access review recommendations A2
Flags unused, mismatched, outlier and stale privileged access with reasons. The reviewer always decides.
Phishing report analysis A3
Header, sender authentication, link and attachment analysis with a verdict and similar-message search.
Vulnerability prioritisation A3
Ranks findings by CVSS, known-exploited flag, asset criticality and exposure with an explanation.
PR summaries and release notes A3
Summarises PR intent and risk areas and drafts release notes from merged PRs for review.
Incident clustering A2
Proposes problem candidates from recurring incidents with the incident list as evidence.
Digital Employees
Agents that operate IT & Security
Rent them by the month. They work under your team's supervision and their cost and returns appear in the Investment & ROI Ledger.
AI IT Helpdesk Agent
Role #87 (W4). Resolves routine IT requests: password resets via the IdP after verification, access request routing and how-to answers. Ceiling A3, max risk R2.
Learn moreAI Access Reviewer
Role #88. Prepares access review campaigns and proposes revocation of unused access for reviewers to decide.
Learn moreAI Security Alert Triage Analyst
Role #89. Enriches and deduplicates alerts, proposes severity and suggests playbook steps for analysts.
Learn moreAI Phishing Report Analyst
Role #90. Analyses reported emails and proposes verdicts and bulk removals.
Learn moreAI Vulnerability Manager
Role #91. Prioritises vulnerabilities, creates remediation tickets and tracks SLAs.
Learn moreAI Change Risk Assessor
Role #92 (W4). Scores IT changes and checks rollback plans before approval. Advisory, ceiling A2.
Learn moreAI IT Asset Manager
Role #93 (W4). Reconciles devices, CIs, assets and IdP accounts and proposes licence reclaims.
Learn moreAI Code Reviewer
Role #98 (W4). Posts PR review comments with findings and security hints; acceptance rate tracked.
Learn moreIntegrations
Connects with the tools you already use
- Microsoft Entra ID
- Google Workspace
- Okta
- Microsoft Intune
- Android Management API
- Apple Business Manager
- Scalefusion
- Hexnode
- ManageEngine Endpoint Central
- Wazuh
- Microsoft Graph security
- Google Workspace alert center
- AWS GuardDuty and Security Hub
- Qualys
- Tenable
- Microsoft Defender vulnerability management
- GitHub
- GitLab
- Jira
- WhatsApp Business Platform
- Slack
- Microsoft Teams
Connector availability depends on provider access and is verified before launch. How integrations work →
Security & compliance
Built to be trusted
R4 Actions need a second person and a second factor
Remote wipe, work-profile removal and regulatory submission require recent strong authentication plus an approver who is not the requester.
Untrusted content cannot drive risky Actions
Alert payloads, ticket text, emails and repository content are marked tainted. A skill reading them cannot plan an R3 or R4 Action without human approval.
Destructive Actions stop when a connector is unhealthy
Device and identity commands are disabled, not silently queued, when the connector is unhealthy.
Data minimisation by design
The app stores alerts and cases, not raw log streams; repository metadata, not source code; work-profile signals, not personal device content.
Tenant isolation and hash-chained audit
Row-level security is enforced and fail-closed on every table, every Action is logged, and security-relevant changes go to a hash-chained audit chain.
BYOD privacy in plain language
Personal devices enrol work-profile only after a notice in the employee's language showing what IT can and cannot see.
Industry Editions
Industries that use IT & Security
Frequently asked questions
When will IT & Security be available?
It is outside Year 1. All four modules are planned for W4 (Year 3). Year 1 delivers platform Identity, Admin & Policy, Trust & Audit and the Desk ticket engine it builds on.
Is this a SIEM or EDR?
No. One3 does not build a SIEM, EDR agent, code scanner, PAM vault or cloud posture scanner. It ingests alerts and findings from the tools you run and turns them into owned work.
Can an AI agent wipe a device?
No. Full wipe and work-profile removal are R4 Actions that always need a human approver who is not the requester, plus a second factor. Bulk wipe is prohibited.
Do we have to replace Intune?
No. Device Management is connector-first: it reads and acts through Intune where you already use it, and adds native Android Enterprise for frontline and kiosk devices.
How does it help with CERT-In reporting?
Security Center is designed to classify incidents against a configured list, start a reporting clock from time noticed and draft the report. Submission is a human R4 Action. Verify requirements with counsel.
Does it read our source code?
DevHub stores metadata such as PRs, pipelines and deployments, not source code.
Works with
Related apps
Platform
One governed foundation for every human, AI agent, integration and channel
ExploreService Desk
Support on every channel, resolved on the same customer, invoice and order records
ExploreWork
Projects, time and product delivery for people and Digital Employees, tied to invoices
ExplorePeople (HR)
Hire, run, pay, develop and engage your workforce on one employee record
ExploreOperations
Buy, stock, make, move, maintain and service physical goods on one Item master
ExploreLegal, Risk & Compliance
Contracts, consent, controls and risk as governed work on the data you already run
ExploreAI Workforce
Rent ready-made AI Digital Employees that work for your team, with a monthly ROI statement
ExplorePlan your IT & Security rollout with us
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.