| TL;DR: When a software flaw is disclosed, businesses must identify affected systems and decide how to protect them. Sevii’s APS uses AI agents to check whether a warning applies to the company, look for signs of a break-in, and fix problems within customer-set rules. The goal is to act before an attack triggers an alert. Customers decide which actions can happen automatically, particularly when taking a system offline could interrupt sales or services. |
A company’s security team receives a warning about a flaw in the software it uses to process online orders. Attackers could use it to break in. The team must find the affected systems and check whether anyone has already gained access.
However, orders are still coming in. Taking those systems offline could interrupt sales. Keeping them running while engineers prepare a fix could leave the business exposed.
Sevii’s Autonomous Preemptive Security module, or APS, aims to help businesses act on new threat warnings faster. Launched in August, it uses AI agents to investigate new threat information and act within rules set by the customer.
That leaves a tricky question. Deciding when an agent can act means weighing security risks against the cost of interrupting orders. So, when could an agent take a system offline, and when would it need someone’s approval?
AI is Finding Flaws Faster Than They Can Be Fixed
Software vulnerabilities remain a common way for attackers to break into business systems. In Verizon’s 2026 Data Breach Investigations Report, exploiting vulnerabilities accounted for 31% of breaches, overtaking stolen credentials as the leading entry point.
The report also found that attackers were using AI to exploit known vulnerabilities in hours rather than months, even before the latest AI models emerged. Curt Aubley, Sevii’s CEO and cofounder, told SaaSTake that businesses must defend “where minutes matter at scale.”
At the same time, AI can also help researchers uncover previously unknown weaknesses. However, finding them is only the first step; teams still have to assess and fix each one.
Anthropic highlighted a similar problem in its May update on Project Glasswing, an initiative that uses advanced AI to help with cybersecurity defense. Of 530 high- or critical-severity bugs it had reported to open-source maintainers, 75 had been patched at that point.
The company expected more patches to follow and acknowledged that some maintainers might already have fixed bugs it hadn’t tracked. Still, its findings were adding to the workload of maintainers who were already stretched thin.
As a result, businesses face a growing stream of warnings. Each warning can flag a real risk without identifying which company systems are affected or what changes are safe to make.
Sevii Connects the Warning to the Customer’s Systems
Sevii’s Autonomous Defense & Remediation platform already investigates security alerts and uses customers’ existing tools to address threats. With APS, the company is extending that work to newly published threat information through vulnerability response automation.
According to Sevii, the module reviews sources such as government advisories and commercial threat feeds. It combines those sources with findings from its own investigations to determine whether a warning affects a particular customer.
From there, it checks which systems are exposed. Where the customer’s rules permit, it can apply fixes or contain threats through automated threat remediation. Sevii says it can turn a new warning into protective action within minutes, recording each decision for review.
Still, acting within minutes doesn’t solve every problem. Aubley points to another bottleneck. Some vulnerabilities need custom patches or additional safeguards, which security and engineering teams may have to develop together.
APS also looks for signs of an existing breach. Patching a vulnerability won’t necessarily remove an attacker who has already gained access. CISA’s June directive on risk-based security updates similarly emphasizes checking for signs of compromise in certain cases.
The directive prioritizes fixes based on how exposed systems are and whether attackers are already exploiting a vulnerability. In certain cases, it also requires federal agencies to check whether a system was breached before the fix.
In other words, installing an update may close a vulnerability, but teams still need to check whether attackers exploited it before the fix was applied.
Existing Alerts Come Before Preemptive Defense
Aubley said customers first need to work through alerts from their existing security tools. Each alert may need investigating before teams can determine what happened and how to respond.
That investigation can involve piecing together information that already exists across security tools and previous cases. Legion Security’s DragonClaw is built to help analysts assemble that context and carry the work into the next security action.
Aubley placed that workload ahead of the next step:
Sevii’s earlier modules deal with threats that have already been detected. APS starts sooner, before anything has triggered an alert.
That move earlier in the security process is showing up at the endpoint too. Glow maps software, AI agents, and developer tools across employee devices so security teams can assess risk before it becomes a detected threat.
That said, the customer’s rules become especially important because APS may act before conventional security tools detect an attack.
Faster Action Depends on Permission Set Earlier
Businesses are still deciding how much freedom to give AI security agents to act on their own. PwC’s Global Digital Trust Insights survey, released October 1, shows how cautious many remain. Only 22% of security leaders would let AI agents act fully on their own to defend against attacks.
Sevii builds customer-set rules into how APS works. Aubley said it carries out fixes only where the customer’s guardrails allow.
Security products can put that approval point in different places. Teleskope’s Kosmo investigates exposed data and recommends what should happen next, while changes to the customer’s systems still require a person to approve them.
Of course, those rules also determine how security decisions affect day-to-day operations. Before letting an agent take a system offline, a company needs to know who relies on it and what downtime would cost.
Making those decisions requires skills many security teams are still developing. The survey found 44% of security chiefs see gaps in AI oversight and governance skills as a top barrier to more agent autonomy.
Asked what security staff need to get better at, Aubley put critical thinking and deep knowledge of their own environment first. According to him:
In his view, that guidance covers deciding what AI agents should and shouldn’t do.
The Warning is Becoming the Starting Line
Sevii’s APS is designed to help businesses act on published threat warnings faster. For a company still taking orders, the aim is to spend less time exposed while it works out what to do.
After all, as AI helps uncover vulnerabilities faster, businesses need to close the gap between discovering a flaw and securing affected systems. Responding to attacks remains essential, but acting on warnings earlier may help prevent some breaches.
