Real Use Cases of AI Agents

So we've already talked about policies, but my two favorite applications are probably in relation to controls monitoring and in relation to third party risk management.

So on

the first one for controls monitoring, It's funny, you know, just I'm going to share a quick anecdote of why it matters and then I'll jump into the agent.

For controls monitoring, I think it's almost, it's hard to believe that, you know, for so many years, the way that we do controls monitoring is that we do point in time checks of certain controls.

And we test one instance from one day of one year.

Maybe we test every three days, five days, 10 days, maybe we test 10 instances, but you're still getting such a narrow window into what the health of that control actually is for your organization.

And for years, we were kind of forced to do this as GRC practitioners, because what other option is there? You know, you can't, it's not physically possible to be eyes on with everything all the time.

Then we went through the change of automation.

And of course, automation allows you to, you know, where an integration exists, do red light, green light checks for certain, you know, for certain controls.

But again, you're limited to a red light, green light check.

It's very black and white.

It's not qualitative.

And you're limited by API integrations.

Now what's happening and what we've built is the ability to have a custom agent do your controls monitoring.

So what that means is, you know, when we onboard a client, we can say, hey, you have your 300 controls or 500 controls.

Just one time, go through and tell us what you look for to mean compliance for your organization in each of these controls.

You can be as specific to your org as you want.

You can say that this vulnerability remediation SLA control needs to show remediation within 30 days.

and it should be a Jira ticket, and it should be approved by our CTO.

Let's just say that, right? All of those things have to be true.

APIs are not going to check for that.

But what our AI does is it actually checks for that.

It checks to that qualitative and specific level that our clients really, really need it to be at.

And I think that that is really, you know, that's amazing.

Because all of a sudden, you're going to point in time checks to eyes on qualitative of reviews that can happen 24-7, 365.

And that's, I think, one of the best use cases for agents when it comes to compliance and GRC is controls monitoring.

I can talk about third-party risk for a long time.

I'll start, I'll do a short version in a moment, but any questions beneath on the controls monitoring agent?

No, but I think what you're saying here is and I want people to make sure that they get that message.

So it's no more compliance check or controls check on an annual or six month or quarterly basis.

It's 24 seven control check on an ongoing basis.

tailored, qualitative control checks on a 24-7, 365 basis.

And those words are important because it's more than just an integration.

For enterprises, integrations have limitations.

Not only do they have homegrown systems, not only do they have siloed systems, but it's also not practical that everything they want to check is a red light, green light integration check.

And so AI unlocks qualitative review.

It unlocks human-like review that saves them Oh, my goodness.

It's funny.

I don't even like to say it saves them time because no one has the time to do it in the first place.

So you're not actually saving time so much as just creating pure value.

So that's that's the controls monitoring agent.

So we've already talked about policies, but my two favorite applications are probably in relation to controls monitoring and in relation to third party risk management.

So on

the first one for controls monitoring, It's funny, you know, just I'm going to share a quick anecdote of why it matters and then I'll jump into the agent.

For controls monitoring, I think it's almost, it's hard to believe that, you know, for so many years, the way that we do controls monitoring is that we do point in time checks of certain controls.

And we test one instance from one day of one year.

Maybe we test every three days, five days, 10 days, maybe we test 10 instances, but you're still getting such a narrow window into what the health of that control actually is for your organization.

And for years, we were kind of forced to do this as GRC practitioners, because what other option is there? You know, you can't, it's not physically possible to be eyes on with everything all the time.

Then we went through the change of automation.

And of course, automation allows you to, you know, where an integration exists, do red light, green light checks for certain, you know, for certain controls.

But again, you're limited to a red light, green light check.

It's very black and white.

It's not qualitative.

And you're limited by API integrations.

Now what's happening and what we've built is the ability to have a custom agent do your controls monitoring.

So what that means is, you know, when we onboard a client, we can say, hey, you have your 300 controls or 500 controls.

Just one time, go through and tell us what you look for to mean compliance for your organization in each of these controls.

You can be as specific to your org as you want.

You can say that this vulnerability remediation SLA control needs to show remediation within 30 days.

and it should be a Jira ticket, and it should be approved by our CTO.

Let's just say that, right? All of those things have to be true.

APIs are not going to check for that.

But what our AI does is it actually checks for that.

It checks to that qualitative and specific level that our clients really, really need it to be at.

And I think that that is really, you know, that's amazing.

Because all of a sudden, you're going to point in time checks to eyes on qualitative of reviews that can happen 24-7, 365.

And that's, I think, one of the best use cases for agents when it comes to compliance and GRC is controls monitoring.

I can talk about third-party risk for a long time.

I'll start, I'll do a short version in a moment, but any questions beneath on the controls monitoring agent?

No, but I think what you're saying here is and I want people to make sure that they get that message.

So it's no more compliance check or controls check on an annual or six month or quarterly basis.

It's 24 seven control check on an ongoing basis.

tailored, qualitative control checks on a 24-7, 365 basis.

And those words are important because it's more than just an integration.

For enterprises, integrations have limitations.

Not only do they have homegrown systems, not only do they have siloed systems, but it's also not practical that everything they want to check is a red light, green light integration check.

And so AI unlocks qualitative review.

It unlocks human-like review that saves them Oh, my goodness.

It's funny.

I don't even like to say it saves them time because no one has the time to do it in the first place.

So you're not actually saving time so much as just creating pure value.

So that's that's the controls monitoring agent.