IT & Security · Digital Employee #91
AI Vulnerability Manager
Prioritise and track fixes
Prioritise and track fixes. AI Vulnerability Manager works for your IT and security team under a named human owner, with its cost and results shown in the Investment & ROI Ledger.
What it does
Mission: Prioritise and track fixes.
AI Vulnerability Manager works for your IT and security team. Typical work: vulnerability prioritisation, ticket creation, SLA tracking. It works inside IT & Security — Security Center, Work — Issues & Sprints. It is a manager agent: it can plan and assign work to other Digital Employees, but it never manages people; it can only propose work to them.
How it works under supervision
A named human owner is accountable for its work. Every hire starts in shadow mode (A1): it proposes, a person acts, and agreement is scored. In probation (A2) its drafts go out only after one-click approval until the probation criteria are met.
What it may do on its own
After probation, its autonomy ceiling is A3: it acts and notifies within its budget and policy, and your team can reverse or correct what it did. Autonomy is earned per skill and drops after an incident.
What needs approval
Its risk ceiling is R1. Once autonomy is earned, it may carry out reversible internal changes, such as updating a field or creating a task, without a separate approval. Anything visible to others or outside your company goes to the Approvals Inbox. R4 Actions (payments, deletion, signing, payroll) always need a person.
Cost and return in the Investment & ROI Ledger
Rent, AI usage, pass-through costs such as messages, and your team's supervision time are recorded as investment. Results are tracked against its KPIs (critical vuln age) and your previous process, shown as observed or assisted unless a reviewed experiment shows incremental return. Nothing is guaranteed.
Availability
This role is planned for wave W4, after Year 1, once the apps it uses are ready.
Skills & Actions
What it does
- Vulnerability prioritisation
- Ticket creation
- SLA tracking
Tools
Apps it works in
- IT & Security — Security Center
- Work — Issues & Sprints
It uses only the apps and modules your workspace subscribes to, with the permissions you grant.
Frequently asked questions
Does AI Vulnerability Manager work without human oversight?
No. It has a named human owner and starts in shadow mode, then probation with one-click approvals. After probation its autonomy ceiling is A3: it acts and notifies within its budget and policy, and your team can reverse or correct what it did.
What does AI Vulnerability Manager need approval for?
Its risk ceiling is R1. Anything visible to others or outside your company goes to the Approvals Inbox. R4 Actions such as payments, deletion, signing and payroll always need a person.
How do I see what AI Vulnerability Manager costs and returns?
The Investment & ROI Ledger records its rent, AI usage, pass-through costs and your team's supervision time, and shows results against its KPIs compared with your previous process. Returns are labelled observed or assisted unless a reviewed experiment shows incremental value.
When will AI Vulnerability Manager be available?
It is planned for wave W4, after Year 1. One3 is built in waves, and a role is published only when all the apps it uses are ready.
Put the AI Vulnerability Manager on probation
Agree the goal, the budget and the approval rules. The Investment & ROI Ledger shows what it cost and what it returned.