Vulnerability Triage Agent
Tells you which five to patch, and why the other four hundred can wait
- 6hard rules
- Things it must never do, enforced in every run
- 5handover rules
- Conditions where it stops and gives the work to a person
- 8output fields
- A structured result, not a paragraph you have to re-read
- ≤6steps per run
- Bounded work: at most 5 tool calls, enforced by the runtime
Read-only by design. This agent has no path to sending, spending, publishing or committing anything. Where that limit is the product, removing it would remove the reason to trust the output.
Overview
A scanner reports four hundred findings. Sorting them by CVSS is not triage — severity is a property of the vulnerability, not of your risk. A critical in a dependency you never call is less urgent than a medium on an internet-facing service holding customer data.
This agent triages against your stack: what you actually run, which components are exposed, and which hold sensitive data. It returns a short ordered list of what to fix now, with the reasoning for each position.
Its more useful half is the dismissal. Every finding it sets aside is listed with why — not reachable, not exposed, compensating control in place, version not affected. That record is what turns a backlog into a decision you can defend to an auditor, and it is what no scanner gives you.
Benefits
~5 actionable
A week's work becomes a morning's
Five ranked items instead of four hundred rows.
Defensible to an auditor
Every deferral has a recorded rationale.
Fewer pointless patches
Effort goes where exposure actually is.
What it does
Ranks by your exposure, not by CVSS
Internet-facing, holding data, actually reachable — the factors that decide real risk.
Dismissals carry reasons
Every set-aside finding records why, so the backlog becomes a defensible decision.
Knows what you do not run
Findings for components absent from your stack are excluded, not ranked low.
Credits compensating controls
A WAF rule or network boundary that genuinely reduces exposure is reflected in the ranking.
Says when it cannot tell
Where reachability is unknown, it says so and ranks conservatively rather than guessing.
What this changes
What this changes about your week
- It takes over
- Deciding which findings actually matter to your deployment.
- Done today by
- A security engineer, drowning in scanner output.
- How often
- Every scan.
- Typical manual effort
- Triaging a few hundred findings honestly is days.
Why Cybersecurity in particular. A scanner sorted by severity is not a plan. Reachability is what decides whether a critical finding is a fire or a footnote.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Vulnerability Triage Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolsfetch_web_page, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Demo
Demo dataIllustrative sample output.
Input
{
"stack": [
{
"version": "1.24.0",
"component": "nginx",
"internetFacing": true,
"handlesSensitiveData": false
},
{
"version": "16.2",
"component": "postgres",
"internetFacing": false,
"handlesSensitiveData": true
}
],
"findings": [
{
"id": "CVE-0000-1111",
"severity": "HIGH",
"component": "nginx",
"affectedVersions": "<1.25"
},
{
"id": "CVE-0000-2222",
"severity": "CRITICAL",
"component": "redis",
"affectedVersions": "all"
}
]
}Output
{
"actNow": [
{
"id": "CVE-0000-1111",
"reason": "Affected version is in use and the component is internet-facing, so it is reachable by an unauthenticated attacker.",
"exposure": "Internet-facing",
"component": "nginx",
"recommendation": "Upgrade nginx to 1.25 or later."
}
],
"summary": "One item to act on. The critical was discarded because the affected component is not run here — severity did not decide the ordering.",
"escalate": false,
"disclaimer": "Analysis only — nothing has been changed on any system. Findings are ranked against the stack and exposure you supplied, no exploit code or proof of concept is included, and no system is described as no longer at risk.",
"notApplicable": [
{
"id": "CVE-0000-2222",
"reason": "Redis is not present in the supplied stack."
}
]
}Requirements
Integrations
No integrations required.
Before you start
- Your stack: components and versions
- Exposure: what is internet-facing, what holds sensitive data
- The findings or advisories to triage
- Requires the All-Access plan or higher
Use cases
Weekly scanner output
Turn a recurring dump into a short ordered queue.
A named advisory lands
Answer 'does this affect us' with reasoning rather than a guess.
Audit preparation
Produce the rationale record for everything deferred.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Does it patch anything?
No, and it cannot. It analyses and recommends. Any change to a running system requires a person — that boundary is enforced by the agent's permissions, not only by its instructions.
How does it know a finding does not apply?
From the stack you describe: components, versions, what is internet-facing, what holds sensitive data, and your compensating controls. Where your description does not settle it, it says so rather than assuming.
Can it replace a scanner?
No. A scanner finds; this decides what to do about what was found. Give it your scanner output.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent