AI Agents for Security Teams That Triage Real Risk, Not CVSS Alone

A security team of six covering 340 services opens the week with 2,300 new CVE alerts and closes 1,900 of them. The backlog does not shrink, it grows by roughly 400 a month, and by the time anyone circles back to last quarter's Critical-tagged findings, half of them have already scrolled off the top of anyone's attention. This is the actual shape of the problem that ai agents for security teams need to solve, not "explain what SQL injection is" but "which 40 of these 1,400 open CVEs are actually being exploited right now, and which 1,360 can wait." Meanwhile the SIEM fires 14,000 alerts a week, tuned years ago for coverage rather than signal, and the on-call engineer has learned to triage by alert title because reading the payload on all of them is not physically possible in an 8-hour shift. And the threat model on file, the one that is supposed to say where the crown jewels sit and what actually protects them, was last touched before the service split into 30 microservices behind an API gateway. None of this is hypothetical. It is Tuesday.

Why a generalist chatbot and Cursor both stop at the first CVE

Paste a CVE into ChatGPT or Claude.ai and it will explain the vulnerability clearly, sometimes even sketch a patch. What it cannot do is look at your actual fleet and tell you whether that CVE is reachable from the internet, whether it sits behind three layers of network segmentation, or whether CISA's Known Exploited Vulnerabilities catalog already lists it as being actively used against targets right now. A generalist chatbot has no state between sessions, no cross-reference against EPSS exploit-prediction scores, no memory of the 1,400 other open findings competing for the same two patch windows this sprint. It will answer the question you asked about the one CVE you pasted in. It will not tell you that CVE is number 380 on your actual priority list, because it does not have a list, and it never will, since nothing persists past the chat window. Ask it to explain CVSS versus EPSS and it will do that well too, in the abstract. Ask it whether your specific 412 Critical-tagged findings are 412 real emergencies or mostly noise, and it has nothing to say, because answering that question requires reading your backlog, not general knowledge about vulnerability scoring.

Cursor and GitHub Copilot solve an adjacent but different problem. They are excellent at writing the regex for a WAF rule once you have already decided you need one, or scaffolding the patch code once you know which CVE to fix first. But autocomplete does not decide what to fix first. It does not read your SIEM's existing rule set and map the coverage gaps against MITRE ATT&CK. It does not design a vulnerability management program with SLA tiers by asset criticality. A security team using Cursor for patch code and ChatGPT for CVE explanations still has to do the triage, the detection engineering, and the threat modeling by hand, which is exactly the part of the job that determines whether the team is defending against real risk or drowning in CVSS noise. That gap does not show up in a demo where someone fixes one CVE on a screen share. It shows up three months later, in the same 400-item backlog, the same 14,000 weekly alerts, and the same threat model nobody has opened since the last architecture review.

Tonone's security-operations team triages CVE backlogs by CVSS, EPSS, and CISA KEV status together, not by CVSS score alone.

Meet Warden, and the security-operations agents it works alongside

Warden is Tonone's security engineer: IAM, secrets management, threat modeling, and hardening, the discipline of finding what is wrong before an attacker does. Warden does not work in isolation on a security team of any size. Blue owns SOC design and detection engineering, the work of turning raw log volume into alerts a human should actually look at. Patch owns vulnerability management, the discipline of scoring and sequencing a CVE backlog against real-world exploitability rather than a static severity number. Where a generalist tool treats "security" as one undifferentiated bucket of advice, these three agents map to three distinct disciplines your team already staffs separately when it has the headcount, and covers thinly when it does not. Before Warden proposes any change, warden-recon runs a full inventory: secrets management, IAM structure, dependency exposure, auth flows, encryption coverage, audit logging, and the compliance gaps sitting underneath all of it. That inventory is the grounding every subsequent decision, Patch's triage order, Blue's detection rules, Warden's own hardening spec, gets built on. A six-person security team rarely has the bandwidth to run this kind of inventory manually more than once a year, if that. Warden runs it on demand, against the codebase and infrastructure as they exist right now, not as they existed at the last audit.

Patch: triaging the backlog by CVSS, EPSS, and KEV, not CVSS alone

Take a security team at a mid-size healthcare SaaS company, call it Meridian Health, with 1,412 open CVEs sitting in a dependency scanner's queue. Under a CVSS-only policy, 412 of those are tagged Critical or High and technically due for immediate remediation, a number no six-person team can clear in a sprint, let alone a week. Patch's patch-triage skill re-ranks the same 1,412 findings using CVSS severity, EPSS exploit-prediction probability, and CISA's Known Exploited Vulnerabilities list together, the three signals a real vulnerability management program actually uses, instead of the one signal a compliance checklist defaults to.

Patch, CVE Backlog Triage, Meridian Health
Recon: 1,412 open findings, CVSS-only ranking, no EPSS or KEV cross-reference.

---------------------------------------------------------------
Tier 1, Fix this week (18 CVEs)
  CISA KEV listed. Actively exploited in the wild.
  12 reachable from the internet-facing API gateway.
  6 reachable only via VPN-restricted admin tooling.
  CVSS range: 6.8 to 9.8 (not uniformly Critical by CVSS alone).

Tier 2, Fix this sprint (54 CVEs)
  EPSS exploit probability above 10 percent, not yet KEV-listed.
  Includes 9 CVEs that were CVSS Medium and would have
  been missed entirely under a CVSS-only SLA.

Tier 3, Scheduled, next patch window (340 CVEs)
  EPSS below 10 percent, CVSS High or Critical, internal-only exposure.
  No SLA breach risk if patched within 30 days.

Tier 4, Accept and monitor (1,000 CVEs)
  CVSS Critical or High, EPSS below 1 percent, vendored dependency
  with no reachable code path today. Re-score monthly, not urgent now.
---------------------------------------------------------------
Result: 72 CVEs need action in the next two weeks, not 412.
Next: patch-plan sets SLA tiers so this backlog stops regrowing.

The number that matters is not 1,412 or even 412. It is 72, the count of findings that actually warrant action in the next two weeks once exploitability, not just theoretical severity, drives the ranking. Nine of those 72 were CVSS Medium, the tier most CVSS-only programs schedule for "eventually," and would have sat unpatched behind hundreds of higher-CVSS, lower-actual-risk findings under the old policy. That is the gap between a backlog that grows faster than it shrinks and one a six-person team can actually clear.

A single triage pass fixes this week's fire. It does not stop next month's backlog from regrowing the same way. patch-plan designs the program underneath the triage: SLA windows by asset tier (internet-facing production gets a 7-day SLA, internal tooling gets 30), escalation paths for SLA breaches, and the metrics that let a CISO answer "are we actually getting faster" with a number instead of a feeling. Run patch-recon first if the team has never had its vulnerability management process audited, it surfaces exactly where the current SLA structure is missing tiers or silently failing before patch-plan designs the replacement.

Tonone's Patch turns a 1,412-CVE backlog into 72 findings that actually warrant action this sprint, by scoring exploitability instead of severity alone.

Blue: turning 14,000 weekly alerts into signal, not noise

The second pain compounds the first: a SIEM tuned years ago, inherited from whoever built it, firing 14,000 alerts a week across a fleet that has doubled in size since the rules were written. Most of those alerts are false positives dressed up as urgent, and the analysts on rotation have adapted the only way anyone can under that volume, by triaging on alert title and moving fast, which means the one alert in 14,000 that represents an actual lateral-movement attempt gets the same thirty seconds of attention as the two hundred that fire every time a scheduled job runs. blue-recon audits the existing detection coverage against the MITRE ATT&CK framework directly, mapping which tactics and techniques the current rule set actually catches and which ones have no detection logic at all, the blind spots nobody has had time to go looking for.

Once the coverage gaps are visible, blue-detect designs the detection rules to close them, SIEM queries, alert logic, and the specific MITRE ATT&CK technique each rule maps to, so every new rule added is traceable to a real gap rather than another generic signature contributing to the same noise problem. The goal is not more alerts. It is alerts an analyst can trust enough to act on the first time they see one, which is the only way alert fatigue actually gets solved, not by hiring more analysts to read more noise, but by cutting the noise at the source. A rule tied to a specific technique also gives the team a defensible answer when leadership asks what the detection budget actually buys, instead of a vague reassurance that "the SIEM is covering it."

Warden: refreshing a threat model against the architecture you actually run

The third pain is the quiet one, because nothing breaks the day the threat model goes stale, until it does. Meridian Health's last formal threat model was written when the platform was a single monolith with one database and one ingress point. Fourteen months later it is 30 services behind an API gateway, three of them handling payment data directly, none of that reflected anywhere anyone can point to when an auditor or a new security hire asks "what's our actual attack surface." warden-threat produces a threat model grounded in the architecture as it exists today, not the one from the last review cycle: the assets worth protecting, the ranked threats against each one given the current service boundaries, the mitigations already in place, and the risks the team is knowingly accepting rather than the ones nobody noticed had changed. That last category, explicitly accepted risk versus silently inherited risk, is usually the gap that turns into the incident nobody saw coming.

Tonone's Warden threat model reflects the architecture you run today, ranking real threats against current service boundaries instead of the ones from the last review cycle.

AI agents for security teams vs the alternatives

The comparison below is specific to what a security team actually needs done day to day, not a generic feature list. A generalist chatbot and an autocomplete editor both have a role somewhere in a security engineer's workflow, but neither one triages a backlog, designs a detection rule mapped to a framework, or produces a threat model grounded in your current architecture.

Install and try

Tonone is free and MIT-licensed. Install it once and Warden, Blue, Patch, and the rest of the Tonone team are available in your Claude Code session immediately. You pay only for the Claude Code token usage during the work itself, the triage, the detection design, and the threat model all show real output, not a description of what output would look like.