Frequently asked questions
Answers about planning, delivery, reporting and saved work.
What can AI Security Planner help a security team do?
Build a security program from a Blueprint, assign and update its work, compare delivery and staffing across programs, and report the result. Alerts support advisory review and follow-up work. The planner records what the team plans and completes; it does not test the effectiveness of security controls.
What is a Blueprint?
A Blueprint is a reusable starting plan. It defines the programs, work, expected outcomes, completion criteria, effort, dependencies and references. Inspect a Blueprint in New programs to see its contents before creating work. A saved program is an editable instance of that plan.
Which kinds of security programs are available?
Built-in programs cover ransomware resilience, identity and privileged access, and exposure management. Other programs address artificial intelligence (AI) governance and security, and technology and vendor optimization. Industrial programs cover operational technology (OT) and industrial control systems (ICS). Custom programs support work outside those starting plans. Multi-program Blueprints combine related programs.
What is needed to create a program?
Select a Blueprint and the destination organization, sites or units. Enter the start date, target date, organization size, weekly delivery capacity and foundations already in place. Some programs require additional context, such as operational and safety conditions for industrial systems. Generate program creates and saves the planned work.
Does the planner use AI to generate schedules?
No. Program schedules use versioned work catalogs and fixed planning rules. Effort, dependencies, capacity and progress determine the forecast. Alerts uses a separate learning model to rank advisories related to review preferences. Its recommendations need expert review.
What does a person-day mean?
A person-day is one day of work by one person. Two people each spending one day contribute two person-days. A weekly allocation of two person-days describes time available for the program, not a team of two full-time people.
Can the generated plan be changed?
Yes. Users with access can edit work, effort, dates, ownership, progress, blockers and decisions. Overview, Kanban, Gantt and Agile show the same saved program through different views. The dependency diagram, called PERT, shows how the work connects. The starting plan remains available as a baseline for comparison.
Why can a program have enough current capacity and still finish late?
Current staffing and the target-date forecast answer different questions. Work may have started late, depend on unfinished prerequisites or need more time before the deadline than the current allocation provides. Read the remaining work, available capacity and forecast date together.
Where is saved work?
My Work contains My Programs, My Notifications, My Conversations and My Analytics. My Analytics brings saved dashboards and reports into one library. Portfolio compares delivery across programs. Capacity manages staffing.
What is the difference between a Dashboard and a Report?
A Dashboard saves a view of current work for repeat use. A Report has its own text, visuals and layout for PDF, Web or Slides. A captured report retains a dated result; live Web content can read current data. Both appear in Analytics.
What does a Report contain?
The content depends on its template. Delivery reports compare work and forecast dates. Capacity reports show resources and commitments. Alerts reports show advisory impact. Access review reports show who has access. Decisions and actions reports show work that needs a decision or response. Custom reports combine text, visuals and tables. Every edition retains its reporting dates, selected sources and commentary.
How is a Report prepared and published?
Open a Dashboard and choose Report. Select the format and branding, then Create. Edit the name, content and layout, then Save to open the preview. Review the pages before Share or download. Template reports can also offer Save draft and a separate Review report step.
Can Reports be exported or shared?
Yes. The preview offers the permitted file download and Share actions. Share selects Users or Groups and creates a link. Link access can expire or be revoked; downloaded files remain outside those controls.
How do Alerts become work in a program?
Inspect the publisher, affected products and versions, timing and proposed remedy. When the advisory applies, use the available planning action to add work to the intended program. Review shared-remediation suggestions before using one change for several advisories. Matching a product name does not establish exposure or a common fix.
What does Similar to starred mean?
It ranks advisories using patterns in the items marked as relevant. The AI inspector explains the main matching signals. A similarity score reflects review preferences; it is not a vulnerability severity rating or proof that an advisory applies to the environment.
Where is program data stored?
Editable programs are saved in the signed-in account or organization workspace. Access to that workspace is required to reopen them. Saving requires a connection. Local browser preferences and program-share revocation keys are separate from the saved program.
How can a program be backed up or transferred?
Export its program-data file in JSON (JavaScript Object Notation) format. Use Import from New programs in a signed-in workspace to restore it. Import checks the file and shows the destination and affected work before confirmation. CSV (comma-separated values), Markdown and program PowerPoint exports support review. Program Share creates a separate read-only snapshot with a 30-day expiry and a revocation control.
What should happen when a save fails or another person has changed the work?
Keep the unsaved edits and read the error before leaving the page. A revision conflict means the server has a newer saved version. Review the available recovery choices and reconcile the changes before saving again. A loading indicator or a click on Save is not confirmation that the work was stored.
Can a service provider work across customers?
Yes, within the access granted by each customer. Both the provider role and the customer delegation must permit the action. Choosing a customer in a filter does not grant access. Customers retain control of their membership, provider grants, final decisions and deletion.
Who controls notifications?
Owners set event delivery and decide which preferences may be delegated. In-app list, real-time notifications and email are separate channels. My Settings show the choices delegated to that person. Opening a notification marks it read; the linked item provides the context for action.
Does completion establish compliance or security effectiveness?
No. Completion records delivery against the stated work and criteria. It does not certify compliance, verify customer evidence or establish that a control works. Those conclusions require the organization’s assessment and evidence process.
Which interface languages are available?
The interface is available in English.
Where are instructions and product changes documented?
Docs explains tasks, controls, expected results and recovery. Inside the application, contextual help explains the current screen or record. Help also opens Product tour, Privacy, Security, Terms of Service, Release Notes and Cookie settings.
Can an assistant connect through MCP?
A read-only Model Context Protocol (MCP) pilot is implemented. It stays off until an operator sets it up. It can search accessible Programs, read one Program execution and list its Milestones. Hosted sign-in and the full ChatGPT flow still need live checks. It is not ready for general use.
Can Owners turn MCP connections off?
MCP is off by default. In Global settings, an Owner can select or clear Allow MCP connections, enter a reason, review the change and save. This blocks existing MCP connections and stops results from requests still in progress. Select the setting again to allow connections. Hosted setup must also be complete. Normal application access and saved work are unchanged.
What access does MCP give an assistant?
MCP uses a separate authorized connection, not the browser session. It checks the current user, Organization membership and application grants on each request. It returns only fully visible Program executions in the token’s Organization. It cannot create, change, delete, share or send work. Personal account Programs, Reports, conversations and attachments are outside this pilot.
Why might an MCP result be missing or require a restart?
Search omits archived Programs and inaccessible or partly visible executions. A missing Site never falls back to the whole Program. Results include source and read dates; reading does not refresh saved evidence. If source data or access changes during pagination, restart that query. If authorization expires or is revoked, reconnect through the approved sign-in flow.