USE CASE · VULNERABILITY MANAGEMENT

Vulnerabilities don't exist in isolation.
Your prioritization shouldn't either.

Most teams prioritize by score. Bricklayer prioritizes by risk; evaluated against real asset exposure, identity access, and active threats in your environment. Reduce time spent on low-impact vulnerabilities. 100% auditable by design.

Scenario 03 · CVE-2020-0796 vulnerability management
TC
You
Bricklayer Assistant

I can perform a vulnerability management workflow using the currently available vulnerability intelligence sources, Qualys integrations, asset inventory systems, policy analysis agents, and ServiceNow automation capabilities.

Proposed investigation plan
  1. Check for new CVE announcements.
  2. Check vulnerable systems in Qualys.
  3. Determine priority level of affected assets.
  4. Make determination on patch viability.
  5. Create ServiceNow ticket for patching.
Investigation in progress
# Task Agent Status
Compiling findings…
Findings so far
  • Vulnerability analysis identified CVE-2020-0796 as an actively monitored vulnerability requiring remediation review across organizational assets. Vulnerability intelligence and Qualys scanning confirmed the presence of affected systems within the environment.
  • Asset inventory and policy inventory analysis determined that affected systems span multiple organizational asset categories, including executive devices, standard employee endpoints, contractor devices, and core infrastructure systems.
  • Executive devices and core infrastructure systems were classified as the highest remediation priority due to elevated monitoring requirements, privileged access, operational sensitivity, and change control considerations. Standard endpoints were categorized as medium priority, while contractor devices were categorized as lower priority due to VLAN segmentation and reduced access levels.
  • Security policy analysis confirmed that patch viability and remediation timelines must align with organizational patch management standards and change control requirements, particularly for infrastructure systems supporting critical business operations.
  • ServiceNow automation workflows successfully generated a remediation ticket for coordinated patch deployment activities associated with CVE-2020-0796. The ticket included affected assets, remediation priority classifications, patching guidance, and escalation details required for operational execution.
  • Vulnerability management workflows confirmed that recurring monitoring, validation scans, and remediation tracking processes are operational and capable of supporting continued vulnerability lifecycle management activities across the environment.
Drafting recommendations…
Recommendations
Recommendation Procedure ready Requires approval Status Action
Prioritize remediation for executive devices and critical infrastructure
Accelerate patch deployment for assets affected by CVE-2020-0796 given elevated operational sensitivity and organizational impact.
Yes Yes Not started
Staged patch deployment for standard endpoints and contractor devices
Roll out patches in phases aligned with organizational patch management policies and approved maintenance windows.
Yes Yes Not started
Change control review for infrastructure patching
Route infrastructure systems through elevated oversight and operational coordination where change risk is highest.
No No Not started
Expand continuous vulnerability monitoring and Qualys validation scans
Improve coverage for newly deployed systems and unmanaged assets so exposure does not persist between scan cycles.
Yes No Not started
Review vulnerability management procedures and automation dependencies
Tighten escalation workflows and reporting accuracy to speed future remediation coordination.
No No Not started
TSTavily Search SME QYQualys SME AIAcme Asset Inventory CSV SME SPAcme Security Policy SME SNServiceNow SME

Hi, I'm your Bricklayer Assistant. I can help you design and execute security workflows such as alert investigations and vulnerability management through conversation.

Connects to your stack
CrowdStrike
Microsoft Entra ID
Microsoft Teams
Slack
Jira
Jira Service Management
Elasticsearch
Azure DevOps
Microsoft Graph API
Gemini
Google
Microsoft 365 Security
BMC
Patch Tuesday
Integration
Integration
Integration
Integration
Integration
Integration
Integration
Integration
THE PROBLEM

High scores don't always mean high risk.

Vulnerability management is full of data,
but short on clarity.

It runs in isolation from the rest of security operations, disconnected from active threats, exposure, and what's actually happening in the environment.

As a result, teams patch what looks critical,
while real risks slip through.

THE APPROACH

What Coordinated AI Agents Actually Look Like.

With Bricklayer, vulnerability management is handled by a coordinated workforce of AI agents under your team's command, working with the tools you already use. Your team, now with the experts they've always needed.

  • Deep expertise across your existing tools and disciplines.
  • Investigates in parallel across areas of responsibility.
  • Shares context across every step, nothing gets lost.
  • Decisions are made with full visibility.
  • Outcomes and learnings improve over time.
  • Every decision is governed, consistent, and auditable.
FROM CONVERSATION TO COMMAND

Five steps. One governed workflow.

Security investigations don't fail for lack of data. They fail for lack of coordination. Here's how Bricklayer turns a conversation into organized, executed, and governed action across your SOC.

STEP 01Conversation

Converse With Assistant.

Turn natural language into structured security workflows. Designed, adjusted, and ready to execute.

  • Conversation-driven design
  • Build an investigation plan
  • Review and refine the plan
  • Execute with one click
  • Save and reuse workflows
STEP 02Reporting

Investigation Reports.

Generate structured reports and audit-ready evidence packages for analyst review and compliance.

  • Generate structured reports
  • Collect and preserve evidence
  • Explain AI reasoning clearly
  • Produce audit-ready outputs
  • Document operational decisions
STEP 03Tasks

Task-Level Execution.

Decompose investigations into discrete tasks, each handled by a specialized agent with traceable outputs.

  • Decompose tasks automatically
  • Assign specialized agents
  • Deliver structured outputs
  • Trace every execution step
  • Reuse operational logic
STEP 04Orchestration

Visual Orchestration.

Visually orchestrate agents, procedures, and execution paths inside a governed workspace.

  • Map task dependencies visually
  • Orchestrate multi-step procedures
  • Converse with agents, question their decisions
  • Coordinate agents in real time
  • Visualize end-to-end operational flow
STEP 05Governance

Procedure Engineering and Governance.

Establish human oversight through governed prompts, structured controls, and reusable procedures.

  • Human-in-the-loop oversight
  • Define structured context and inputs
  • Build and reuse procedures at scale
  • Engineer and version prompts
  • Maintain operational control and governance
AT SCALE

What This Looks Like at Scale

Real-world risk prioritization, not static scores
Exploitable vulnerabilities identified faster
Reduced low-impact remediation work
100% auditable agent activity
Fix what actually matters.
IN PRODUCTION

Already running across enterprise environments.

Based on a deployment in a global high-tech company managing CVE-scale vulnerability programs:

Global high-tech company

10.2-minute average assessment time

26,600+ hours saved

Global high-tech company

$1.6M+ cost savings

Continuous validation across the asset base

WHY BRICKLAYER

A workforce, not a workflow.

Most AI SOC platforms automate the work. Agents operate independently. Context resets between steps. And when something goes wrong, there's no clear record of why a decision was made.

Our AI agents go farther. They share context, work as a coordinated team, and provide full visibility for analysts. Bricklayer's agentic cybersecurity platform is a workforce for the AI SOC, operating under human control.

Bricklayer Agents — coordinated AI agent team operating under human control
ONE PLATFORM

Bricklayer Connects Your Security Operations

One platform aligned to how your SOC works. Bricklayer unifies the workflows that typically live across disconnected tools. No rework required. Just expansion and opportunity.

No rework required. Just expansion and opportunity.

See how exploitable vulnerabilities are prioritized
in your environment.

Security analyst at workstation