Axonius Launches AI Workforce to Automate Security Remediation with Human Approval
The new platform deploys virtual workers to monitor assets and execute fixes, routing sensitive actions through structured checkpoints for human review.
Key points
- Axonius AI Workforce uses virtual workers to identify high-risk exposures and remediate issues autonomously.
- Sensitive actions require human-in-the-loop approval, while routine tasks like labeling run automatically.
- The system operates in Off, Shadow, or Live modes to control the level of automation and risk exposure.
Axonius announced the launch of Axonius AI Workforce, an expansion of its existing Axonius AI platform, according to Help Net Security. The new capability allows organizations to deploy teams of virtual workers that monitor environments, identify deviations from expected states, and remediate security issues.
The platform is designed to address the fragmentation of security data across dozens of disconnected tools. According to Help Net Security, the current constraint for IT and security teams is not data volume, but the ability to trust answers derived from cross-tool queries and take appropriate action.
Context and Background
Most existing automation operates on fixed schedules, triggering jobs that check conditions defined months earlier. Help Net Security reported that this approach fails when environments change in unanticipated ways, leaving manual tasks such as connecting critical assets to compromised identities or finding owners of orphaned cloud workloads to fall on human teams.
Axonius AI Workforce aims to handle this standing work by acting on decision-grade data from the Axonius Asset Cloud. Rather than relying on a single tool’s view or a standalone vulnerability finding, the virtual workers use comprehensive asset intelligence. This approach allows the system to track specific security outcomes over time, including threat intelligence, shadow AI, data completeness, and post-quantum cryptography readiness.
Who Is Affected
Security and IT teams managing complex, multi-tool environments are the primary users of this system. The platform introduces three modes of autonomy: Off, Shadow, and Live. In Off mode, the system always stops for human approval. Shadow mode previews what the virtual worker would do, while Live mode applies actions automatically within set guardrails.
Each job is tagged with a recommended start mode based on Axonius best practices. This structure allows teams to control the level of autonomy. Routine work, such as dashboard creation and asset labeling, runs without review. However, sensitive actions, including outbound communication and changes to connected systems, surface for approval before execution.
What should you do?
Organizations evaluating autonomous security tools should review the approval workflows and guardrails provided by the vendor. It is important to understand which actions trigger human-in-the-loop checkpoints and which run automatically. Teams should start with Shadow mode to preview actions before enabling Live mode for automatic remediation.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: Axonius
- Review the vendor’s documentation on human-in-the-loop checkpoints to understand which sensitive actions require approval before execution.
- Start virtual workers in Shadow mode to preview recommended actions and verify they align with organizational security policies.
- Monitor the progress reports generated by virtual workers to ensure remediation efforts are tracking toward assigned security goals.
- Audit the asset intelligence sources connected to the platform to ensure the data driving automated decisions is complete and accurate.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Axonius AI Workforce?
It is an expansion of Axonius AI that deploys virtual workers to monitor environments, identify high-risk exposures, and remediate issues.
How does the system handle sensitive actions?
Sensitive actions, such as outbound communication and system changes, pass through a structured checkpoint for human-in-the-loop approval before execution.
What are the autonomy modes available?
The system offers Off mode for full human approval, Shadow mode for previewing actions, and Live mode for automatic application within guardrails.
