AI assistance
Where AI is applied across triage, remediation guidance, reporting and researcher support — and where human judgement is required.
AI on AXUM SEC is applied to the parts of running a security program that do not scale by hiring: classification, overlap detection, drafting and summarisation. It is designed to take administrative load off the team, not to replace the decisions that carry contractual or legal weight.
Where it is applied
| Capability | What it does | Human decision that remains |
|---|---|---|
| Automated triage | Classifies a submission and predicts severity so reviewers start from a proposal | Severity confirmation and reward pricing |
| Duplicate intelligence | Flags likely repeats, including across programs | Merge, attribution and reward split |
| Remediation guidance | Technology-specific fix guidance with before/after examples and testing steps | Whether the fix is acceptable |
| Report generation | Drafts structured reports from raw findings and evidence | Review, edit and sign-off |
| Threat modelling assistance | Supports structured threat modelling workshops and output | Model validity and prioritisation |
| Policy generation | Drafts program and disclosure policy text aligned to your program | Legal review |
| Risk scoring | Model-based scoring to support prioritisation | Acceptance of the score |
| Researcher assistant | Helps researchers structure a submission before it reaches triage | Validation on arrival |
Remediation guidance
Guidance is written for the technology in use rather than in generic terms, covering the languages and frameworks most commonly found in customer codebases — Node.js, Python, Java, PHP, Go and their common frameworks.
Each guidance block typically contains:
- What the issue is in plain language, tied to the affected code path.
- Why it is exploitable, including the preconditions.
- A before/after example showing the vulnerable pattern and a corrected one.
- Testing steps — how to confirm the fix actually closes the finding rather than hiding it.
Guidance is a starting point for the engineering team, not a substitute for their understanding of the codebase.
Report generation
Reports assembled from raw findings keep the structure auditors and stakeholders expect: summary, severity, affected assets, reproduction, evidence, impact and remediation. Drafting is automated; the reviewer edits and approves before anything is published or attached to a compliance pack.
The researcher assistant
Submissions improve when the reporter gets help before they hit send. The assistant prompts for missing reproduction steps, checks that the affected asset is in scope, and suggests the evidence a triage team will ask for. Higher quality input means a higher validation rate and less back-and-forth for everyone.
What it does not do
- It does not auto-close reports on similarity alone.
- It does not set the reward — pricing follows the program's severity model and the reviewer's decision.
- It does not replace legal review of disclosure policy, or tax and compliance advice on payouts.
- Drafted content is always attributed as drafted and requires human approval before it leaves the platform.
Availability and limits
- AI triage, duplicate intelligence and automated payouts are Professional-tier.
- Threat modelling assistance and advanced vetting are Enterprise-tier.
- Availability of individual features can change; confirm the current tier on the platform's plan comparison before relying on a capability in a contract.
Related docs
- Triage pipeline — where classification and duplicate checks happen
- Duplicate intelligence — the duplicate model in detail
- Remediation and verification — from guidance to a verified fix