Security Agent Manual

1. What the Security Agent does

The Security Agent is your always-on AI security officer. It monitors your systems for vulnerabilities, unauthorized access, data exposures, and compliance drift — and acts on findings automatically where it safely can. Everything else it escalates to you with a clear recommended action.

Unlike a one-time penetration test, the Security Agent watches continuously. New CVEs that affect your stack are detected within hours of disclosure. Access reviews happen on schedule, not when an auditor demands them. Secrets accidentally committed to repositories are caught before they circulate.

What it monitors

2. Security score explained

Your security score is a 0–100 number calculated every hour. It reflects the overall posture of your systems based on open vulnerabilities, compliance gaps, access review status, and recent security events. A higher score means lower risk.

Score breakdown

Score thresholds

Ask the agent for a score explanation at any time: "Why is our security score 67? What are the top 3 things I can fix to raise it above 80?"

3. Vulnerability and CVE monitoring

The agent continuously monitors the National Vulnerability Database (NVD) and major advisory feeds for CVEs affecting your stack. When a new CVE is published that matches a library or package you use, you receive an alert within hours — before public exploits are weaponized.

How to register your stack

CVE alert tiers

Getting a vulnerability report

4. Security event detection

The Security Agent monitors your authentication logs, API access patterns, and infrastructure events for anomalous behavior. It uses a baseline built from your normal traffic patterns and flags deviations that warrant investigation.

Events the agent detects

Connecting log sources

The agent ingests logs from your auth provider, application, and infrastructure. Tell it where your logs live:

5. Access reviews

Access reviews verify that every person with access to a system still needs that access. The agent runs reviews on a schedule you define and generates a structured report showing who has access to what, when they last used it, and whether the access looks appropriate.

Setting up access reviews

What a review report includes

Acting on a review

Review the report and tell the agent what to do: "Deactivate the AWS IAM user legacy_deploy — it has been inactive for 180 days and is no longer needed. Also demote user contractor_alice from admin to read-only on the GitHub organization."

6. Compliance tracking

The agent tracks your compliance against security frameworks and company policies. It maps your current controls to framework requirements and tells you exactly which controls are passing, failing, or not yet implemented.

Supported frameworks

Getting a compliance report

Continuous compliance monitoring

Rather than point-in-time audits, the agent monitors compliance continuously. When a configuration change causes a control to fail — for example, disabling MFA on an admin account — you receive an alert immediately rather than discovering it during an audit six months later.

7. Secret scanning

Leaked credentials are the most common way attackers gain initial access. The agent scans your repositories, CI/CD logs, and environment configurations for accidentally exposed secrets — API keys, tokens, private keys, database URLs, and passwords.

How to set up secret scanning

What the agent looks for

Secret rotation workflow

When a secret is found, tell the agent: "I have rotated the Stripe key. The new key starts with sk_live_Abc. Update all references you know about and confirm the old key is gone from the codebase."

8. Attack surface and DNS monitoring

Your attack surface is everything an attacker can reach from the outside: open ports, exposed admin panels, public cloud storage, misconfigured CORS, and forgotten subdomains. The agent maps and monitors all of it.

What gets monitored

Subdomain takeover risk

Subdomain takeover happens when a DNS CNAME record points to a cloud service (Heroku, GitHub Pages, S3, Vercel) that no longer exists. An attacker can claim the deleted service and receive traffic intended for your subdomain. The agent detects these automatically and alerts you to remove or fix the dangling record.

Setting up attack surface monitoring

9. Threat intelligence

The agent monitors threat intelligence feeds to check whether your domains, IPs, or employee emails have appeared on blocklists, in breach databases, or in dark web marketplaces. Knowing before your customers or regulators is what matters.

What is checked

Responding to a breach database hit

10. Pentest management

The Security Agent manages your penetration testing engagements end-to-end — from scoping and scheduling through to tracking remediation of findings. It does not perform the pentest itself (that requires human security researchers), but it coordinates the entire process and tracks all findings as structured tickets.

Starting a pentest engagement

Finding lifecycle

Tracking remediation

Every finding is created as a structured ticket and tracked like any other security ticket. The agent monitors remediation progress and alerts you when findings approach their due date unresolved. After fixes are deployed, it notifies the pentest team for retest.

Executive report

At the end of a pentest engagement, ask: "Generate an executive summary for the July pentest engagement. Include: total findings by severity, how many are remediated, how many are outstanding, and what the overall risk posture improvement looks like."

11. Communicating with your agent

Your Security Agent session has a dedicated email (security-a3f9b2c1@agents.boboyka.com) and a live chat panel at hire.boboyka.com/session/[id]. Both share the same conversation history.

Things you can ask the agent

12. Tier capabilities

13. Troubleshooting

My security score dropped significantly overnight

Ask the agent directly: "Our score dropped from 78 to 61 overnight. What changed?" The agent will show you the exact factors that changed — typically a new critical CVE was published, a compliance control started failing, or a new finding was classified as high severity.

The agent found a secret — what do I do right now?

A pentest finding is marked false positive but the agent keeps tracking it

Tell the agent: "Mark pentest finding PT-024 as false positive. Reason: the CORS wildcard is intentional — the endpoint only serves public data and has no authentication." The agent records the reason and removes it from the open findings count. The finding is retained in the audit trail.

Access review is flagging contractors as inactive

Contractors often have lower activity during off-project periods but still need persistent access. Tell the agent: "Exclude users with the GitHub label 'contractor' from the inactivity threshold — use a 180-day threshold instead of 90 days for contractors."

I received a threat intel alert about my domain on a blocklist

This usually means one of your servers sent spam or was used in an attack. Ask the agent: "Our domain mycompany.com is on the Spamhaus blocklist. Which of our IPs caused this and how do I get delisted?" The agent will identify the source and provide the delisting steps for the specific blocklist.