Axonius Launches AI Workforce Virtual Workers for Automated Remediation

Asset intelligence vendor Axonius Inc. added the Axonius AI Workforce to its Asset Cloud platform today, allowing security teams to assign ongoing remediation tasks to autonomous, artificial intelligence-powered virtual workers. This launch aims to handle follow-up work that security teams often lack the time to perform manually.

The new platform addresses the challenge of fragmented asset data spread across dozens of tools. Axonius states that scheduled jobs typically only catch pre-defined conditions, leaving out-of-scope issues for manual resolution. The AI Workforce is designed to take over these residual tasks, such as investigating why a specific endpoint agent stopped reporting data.

Operational Mechanics and Governance

The AI Workforce includes more than 50 distinct virtual worker types covering security outcomes like exposure triage, shadow AI detection, and post-quantum cryptography readiness. Each worker tracks a specific metric tied to its assigned outcome, eliminating the need for teams to build custom reports to monitor improvement. When an asset drifts from its desired state, the responsible worker executes the fix, and results feed into a Daily Digest ranked by urgency.

Governance is managed through a mode setting that determines how far a worker can act independently. Axonius recommends a starting mode for each job based on best practices. In Off mode, the worker waits for human approval on every action. Teams can use Shadow mode to preview proposed actions before switching to Live mode for automatic execution within set guardrails.

Integration and Data Access

Two other tools announced in July also moved to general availability today: the Axonius AI Companion and the Axonius MCP Server. The AI Companion allows users to ask plain-language questions about their environment and act on answers within the same conversation, such as opening tickets or tagging devices. The MCP Server enables external AI tools and agents to access the same asset data via the Model Context Protocol.

Each customer runs a private large language model instance within a dedicated environment. An audit trail marks every action as either agent-driven or human-driven. Outbound messages and changes to connected systems are considered sensitive and are held for approval before execution. This approach aligns with the structured checkpoint strategy Axonius introduced when it first deployed virtual workers for human-approved remediation, as Threat Times reported on October 19, 2026.

What should you do?

Security professionals should evaluate their current remediation workflows to identify tasks suitable for automation. Review the available virtual worker types to determine which align with your organization's security outcomes. Test the Shadow mode to observe proposed actions before enabling Live mode for automatic execution. Ensure that audit trails are configured to distinguish between agent-driven and human-driven actions.

Background: Large language models

Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.

Read the full guide: Large Language Models vs Generative AI: The Distinction and Security Implications

What to do and how to stay safe

• Review the list of available virtual worker types to identify which security outcomes, such as exposure triage or shadow AI, are relevant to your organization.
• Configure the governance mode to Off

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.