Tells you which five to patch, and why the other four hundred can wait
A scanner reports four hundred findings. Sorting them by CVSS is not triage — severity is a property of the vulnerability, not of your risk. A critical in a dependency you never call is less urgent than a medium on an internet-facing service holding customer data.
This agent triages against your stack: what you actually run, which components are exposed, and which hold sensitive data. It returns a short ordered list of what to fix now, with the reasoning for each position.
Its more useful half is the dismissal. Every finding it sets aside is listed with why — not reachable, not exposed, compensating control in place, version not affected. That record is what turns a backlog into a decision you can defend to an auditor, and it is what no scanner gives you.
~5 actionable
Five ranked items instead of four hundred rows.
Every deferral has a recorded rationale.
Effort goes where exposure actually is.
Internet-facing, holding data, actually reachable — the factors that decide real risk.
Every set-aside finding records why, so the backlog becomes a defensible decision.
Findings for components absent from your stack are excluded, not ranked low.
A WAF rule or network boundary that genuinely reduces exposure is reflected in the ranking.
Where reachability is unknown, it says so and ranks conservatively rather than guessing.
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
Demo dataIllustrative sample output.
{
"stack": [
{
"version": "1.24.0",
"component": "nginx",
"internetFacing": true,
"handlesSensitiveData": false
},
{
"version": "16.2",
"component": "postgres",
"internetFacing": false,
"handlesSensitiveData": true
}
],
"findings": [
{
"id": "CVE-0000-1111",
"severity": "HIGH",
"component": "nginx",
"affectedVersions": "<1.25"
},
{
"id": "CVE-0000-2222",
"severity": "CRITICAL",
"component": "redis",
"affectedVersions": "all"
}
]
}{
"actNow": [
{
"id": "CVE-0000-1111",
"reason": "Affected version is in use and the component is internet-facing, so it is reachable by an unauthenticated attacker.",
"exposure": "Internet-facing",
"component": "nginx",
"recommendation": "Upgrade nginx to 1.25 or later."
}
],
"summary": "One item to act on. The critical was discarded because the affected component is not run here — severity did not decide the ordering.",
"escalate": false,
"notApplicable": [
{
"id": "CVE-0000-2222",
"reason": "Redis is not present in the supplied stack."
}
]
}No integrations required.
Turn a recurring dump into a short ordered queue.
Answer 'does this affect us' with reasoning rather than a guess.
Produce the rationale record for everything deferred.
$349/month
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits.
No, and it cannot. It analyses and recommends. Any change to a running system requires a person — that boundary is enforced by the agent's permissions, not only by its instructions.
From the stack you describe: components, versions, what is internet-facing, what holds sensitive data, and your compensating controls. Where your description does not settle it, it says so rather than assuming.
No. A scanner finds; this decides what to do about what was found. Give it your scanner output.
No reviews yet. Reviews open once customers have run this agent.
Tell us what to change and our team will scope a customised version for your business.
Customize this agent