For security teams with more findings than time.
Vulnerability management that learns.
aisy investigates every ticket to learn how your company works. The next finding arrives with the cause, the owner and the fix. When an exception or exclusion stops being safe, it tells you.
Queue
QUA-4411
Apache HTTP Server flaw on billing-02
Qualys · CVE-2024-38476 · Critical
Why it matters here
This flaw was fixed twice, but each redeploy brings it back.
Closed as fixed in March and June (SEC-3120, SEC-3877)
Each redeploy rebuilds it from the 2024 image pinned in infra/base.tf
6 other servers run the same image
Recommended fix
Update the pinned image, not the server
Resolves this finding and 6 other tickets
Works on the findings and tickets you already have. Read-only, nothing to migrate.
Each investigation puts you one step ahead of attackers.
aisy doesn’t stop at the ticket. It finds the cause, learns what’s true, and uses it to stop the next problem.
Decide
Act
Learn
1
Brings its own evidence
aisy works out whether the flaw matters at your company: whether it can be reached, whether the affected feature is in use, and whether it keeps coming back. It uses your own tools and its own checks. When it can’t answer a question, it tells you who can.
2
One decision per cause
The same flaw comes in as a separate ticket for every server it’s on. aisy finds the cause they share, so one fix closes them all and keeps them closed.
3
Every ticket teaches it how your company works
The code maps billing-02 to billing.mostlyfine.io, and an outside scan finds that address open to the internet. A Jira comment says it runs as the billing service account, and Wiz shows that account can read the payments database. aisy keeps what it learns, and updates it when that changes.
4
The next decision starts from what it learned
With what it knows, aisy flags a change that would bring the problem back, before a scanner or an attacker sees it.
Queue
QUA-4411
Apache HTTP Server flaw on billing-02
What decides it here
4 answered · 1 open
Reachable from the internet?
Yes
aisy reached it from outside, through the public load balancer
Affected feature in use?
YesIt proxies the invoice backend (httpd.conf)
Exploited in the wild?
NoNo known exploitation or public exploit
A regression?
YesFixed twice, back after each redeploy (SEC-3120, SEC-3877)
Owner known?
OpenNo owner for infra/base.tf, and two teams deploy from it
What it means
Exposed, and it keeps regressing: fix the image this sprint.
Ask the platform team who owns billing-base before you assign it.
Each investigation puts you one step ahead of attackers.
aisy doesn’t stop at the ticket. It finds the cause, learns what’s true, and uses it to stop the next problem.
1
Decide
Act
Learn
Brings its own evidence
aisy works out whether the flaw matters at your company: whether it can be reached, whether the affected feature is in use, and whether it keeps coming back. It uses your own tools and its own checks. When it can’t answer a question, it tells you who can.
Queue
QUA-4411
Apache HTTP Server flaw on billing-02
What decides it here
4 answered · 1 open
Reachable from the internet?
Yesaisy reached it from outside, through the public load balancer
Affected feature in use?
YesIt proxies the invoice backend (httpd.conf)
Exploited in the wild?
NoNo known exploitation or public exploit
A regression?
YesFixed twice, back after each redeploy (SEC-3120, SEC-3877)
Owner known?
OpenNo owner for infra/base.tf, and two teams deploy from it
What it means
Exposed, and it keeps regressing: fix the image this sprint.
Ask the platform team who owns billing-base before you assign it.
2
Decide
Act
Learn
One decision per cause
The same flaw comes in as a separate ticket for every server it’s on. aisy finds the cause they share, so one fix closes them all and keeps them closed.
Queue
QUA-4411
Apache HTTP Server flaw on billing-02
Recommended fix
Update billing-base in infra/base.tf and redeploy
Resolves 7 tickets across 4 services
Tickets this fix resolves
7 tickets
QUA-3962
Apache HTTP Server flaw on billing-01
Critical
QUA-4411
Apache HTTP Server flaw on billing-02this ticket
Critical
WIZ-1187
Outdated httpd in the billing-03 image
High
PLAT-2210
Upgrade Apache on invoices-01
High
WIZ-1203
CVE-2024-38476 on payouts-01
Critical
QUA-4127
Apache 2.4.58 multiple vulnerabilities, payouts-02
Critical
QUA-4416
Apache HTTP Server flaw on reports-01
Critical
3
Decide
Act
Learn
Every ticket teaches it how your company works
The code maps billing-02 to billing.mostlyfine.io, and an outside scan finds that address open to the internet. A Jira comment says it runs as the billing service account, and Wiz shows that account can read the payments database. aisy keeps what it learns, and updates it when that changes.
Qualys
Apache flaw reported on billing-02
Code review
billing-02edge load balancerbilling.mostlyfine.ioinfra/edge.tf
Outside scan
billing.mostlyfine.io answers from the internet
SEC-3877
Priya: “Patched and restarted it as the billing service account.”
Wiz
The billing service account can read the payments database
aisy learns
billing-02 is open to the internet, and the account it runs as can read payment data.
4
Decide
Act
Learn
The next decision starts from what it learned
With what it knows, aisy flags a change that would bring the problem back, before a scanner or an attacker sees it.
mostlyfine / infra
Add invoices-02 #812
platform-team wants to merge 1 commit into main
aisy
botcommented 2 minutes ago
This server would ship with the Apache flaw you fixed last week.
It pins billing-base 2024-11, the image behind QUA-4411 and 6 other tickets.
Suggested change
Every exception has a reason. Your findings show when it changes.
What aisy learns from your findings lets it work ahead of the queue. It starts with the risks you accepted and the systems you left out of a scan, and tells you when the reason for one stops holding.
Decide
Act
Learn
Mon
Mon
Billing portal exception
“Hold off patching the billing portal until it retires in December.”
Exception ticket, March
Since then
No longer holds: Internal only
A live finding on the partner API exposes it.
No longer holds: No public exploit
One went public last week.
Still holds: Retires in December
Still on track.
Reopen the exception
Sent to
#security
Tue
Every call still holds.
Wed
Wed
Sandbox scan exclusion
“Leave the sandbox account out of Wiz. It holds no customer data.”
Exclusion request, May
Since then
Your AWS logs show an export job copied customer records into it on Monday.
Bring the sandbox back into scans
Sent to
ticket for the cloud team
Thu
Every call still holds.
Fri
Fri
Designers’ USB exception
“USB stays on for the 10 designers while they use the Figma plugin.”
IT security chat, January
Since then
Intune shows the plugin gone from 7 of the 10 laptops.
Turn USB off on those 7
Sent to
#it-security
Built on real
attacker judgment.
$20M+ in real findings
Having adjudicated over $20M+ in bounty rewards for findings at Zoom, Salesforce, AWS, and the Pentagon, we understand attacker ROI and the real-world impact of exploits. That adversarial perspective is what powers the product - ensuring your resources target the paths sophisticated attackers actually prioritize.
Built by people who have done the work
Nearly a decade in offensive security, backed by researchers from DeepMind and practitioners from HP, Cisco, DocuSign, and the security research community.
Designed for real environments
Except for Jira, aisy is read-only. We never train on your data. We come from a world where getting things wrong has real consequences, and that discipline extends to how we handle yours.
Vulnerability management that learns.
See it on your findings and your exceptions.
Not ready for a demo? Find packages you can remove.
Drop in your manifest and lockfile. In about a minute, you get the list and a prompt to clean it up.
Free. No account needed.