Visot
Capabilities Applied AI Security Visot SIEM Docs Talk to our team

Applied AI Security

We build AI workflows into the security and IT operations you already run. An engineer works with your team through implementation, then stays on a lighter retainer to tune what has been built and add more.

WORKFLOW RUN · ALERT-TRIAGERUNNING
Grouped 14 related alerts into one case0.4s
Enriched with asset owner, user risk and threat intel1.2s
Guardrails checked: host not protected, within rate limit0.1s
Proposed: isolate host FIN-WS-0142Awaiting approval · on-call J. Okafor—
ApproveRejectAsk why

How an engagement works

Four phases, from the first workshop to workflows your team relies on. Most clients have their first workflows in production within eight to ten weeks.

01 · 2 WEEKS Assess An engineer sits with your team and maps how work actually gets done: what triggers it, what information is needed, who decides and where the time goes.
—Operations map —Shortlist of workflows ranked by hours saved
02 · 4 TO 6 WEEKS Build The engineer builds each workflow, configures the skills it needs and connects it to your tools. Guardrails and approvers are agreed with you before anything runs.
—Configured workflows —Guardrail and approver register
03 · 2 TO 4 WEEKS Run side by side Workflows run in observe mode next to your team. Every decision is compared with what your people did, and differences are reviewed daily.
—Side-by-side report —Go-live sign-off per workflow
04 · ONGOING RETAINER Improve After go-live the engagement moves to a lighter monthly retainer: tuning, new workflows as your needs change, and a monthly review with your team.
—Monthly performance review —New workflows on request
TYPICAL TIMELINE
W1W2W3W4W5W6W7W8W9W10→
Assess
Build
Run side by side
Improve
Faded segments show the range. The retainer starts once the first workflows are live.

Operations we cover

Each area starts from a library of tested skills. Your engineer configures them around your playbooks, tools and approval rules.

01 SOC & alert triage

Every alert is read, enriched and either closed with a written reason or escalated to a person.

—Endpoint and identity alert triage —Phishing reported by users —Grouping duplicate alerts into one case
02 Incident response

Workflows scope the incident, propose containment and keep the timeline current while your responders decide.

—Host isolation with approval —Compromised account containment —Stakeholder status updates
03 Vulnerability management

Scanner output becomes a short, ranked list of what to fix first, tracked until it is closed.

—De-duplication across scanners —Ranking by exploitability and asset criticality —Fix verification by targeted re-scan
04 GRC & compliance

Evidence is collected continuously, so audits stop being a two-month project.

—Control evidence collection —Control testing and failure tickets —Audit packs for SOC 2, ISO 27001, HIPAA and PCI DSS
05 Vendor & third-party risk

Questionnaires are drafted from your policy library and vendors are assessed on a schedule.

—Customer questionnaire drafting with sources —Vendor questionnaire scoring —Certification expiry tracking
06 Cloud security

Misconfigurations across AWS, Azure and GCP are found, ranked and fixed through your change process.

—Public exposure checks —Drift from approved baselines —Remediation with approval
07 IT operations

Routine IT requests and hygiene tasks are handled end to end, with your service desk in the loop.

—Access requests and approvals —Joiner, mover and leaver tasks —Patch compliance reporting
08 Identity & access

Access is reviewed continuously instead of once a quarter.

—Quarterly access reviews —Stale and orphaned account clean-up —MFA and privileged access gap checks
+ Something else?

If a recurring task is not listed here, your engineer can scope a workflow for it during the assessment.

Talk to our team

Your engineer

One named engineer leads your engagement from the first workshop. Behind them sit Visot’s detection, response and compliance specialists.

During implementation
—Runs the mapping workshops with your team —Builds and configures every workflow —Agrees guardrails and approvers with you —Reviews side-by-side results daily —Trains your team on approvals and parameter changes
On retainer
—Monthly review of workflow performance —Tuning when your tools or processes change —New workflows as your needs grow —Support in your shared Slack or Teams channel —24/7 hotline for P1 incidents

Where workflows run

Decided per client, based on your tools, data residency and how much you want to run yourselves.

In your tools Workflows run inside your existing SIEM, SOAR, ticketing and messaging tools. Nothing new for your team to log into.
On the Visot platform Workflows run on the Visot platform, connected to your tools through scoped credentials, with a console for cases, approvals and audit.
Who owns what You own the workflows, playbooks and configuration built for your environment. Visot licenses the underlying skills library and platform, and keeps them updated.

People stay in control

Every action a workflow can take has an autonomy level. Everything starts at Observe and moves up only with your sign-off.

LEVEL 1 Observe Records what it would have done. Takes no action.
LEVEL 2 Recommend Proposes the action with evidence. A person carries it out.
LEVEL 3 Act with approval Prepares the action and waits for a named approver.
LEVEL 4 Act autonomously Runs and notifies. Limited to low-risk, well-proven actions.
What an approver sees

Each request shows the proposed action, the evidence, the workflow’s reasoning, the expected impact and the rollback. Approvers respond from Slack, Microsoft Teams or the console. Unanswered requests escalate along your on-call rota.

Read about guardrails in the docs
APPROVAL NEEDED · P2 · CASE-20417WAITING 2M
Isolate host FIN-WS-0142 Encoded PowerShell spawned vssadmin to delete shadow copies. Matches ransomware precursor pattern T1490.
IMPACTUser loses network access; EDR channel stays open
ROLLBACKrelease_host, one click
GUARDRAILSNot protected · within rate limit
REQUESTED BYIncident response workflow
ApproveRejectAsk why

Start with a two-week assessment.

We map your operations and show you which workflows would save your team the most time.

Talk to our team
SAMPLE · OPERATIONS MAP · WEEK 2READY
TASKPER WEEKHOURSFIT
Alert triage42084High
Access requests16040High
Vendor questionnaires630Med
Phishing reports9022High
Evidence collection—18Med
Leaver tasks129High
6 workflows shortlisted203 h / week in scope