CyberSpec agents

A security crew of AI agents, for teams that don't have one

CyberSpec's agents split up the work a security team would do: watch what you expose, work out what each finding means and what to fix first, tell the right person, and write it up. For an MSP that means every client's domains get checked on a schedule, not just in the week before a Cyber Essentials assessment.

Each agent below is marked LIVE or ROADMAP, and AI or Automation, so you can tell a scheduled job from a model call.

Explain and Triage run on the Free plan, capped at 5 AI calls a day. Brief's PDF executive summary needs the MSP plan, which allows 50 AI calls a day.

ScoutLIVE

Watches your attack surface

Automation

Re-scans every verified domain, IP and range on the schedule you set, and names the software it finds (WordPress, Next.js, PHP) with its version.

Scheduled and on-demand scans of verified assets only
Framework and CMS detection with version where exposed
End-of-life and outdated-version checks against endoflife.date

ExplainLIVE

Turns findings into fixes

Writes what each finding means, why it matters and how to fix it, in plain English. It uses only the scanner's own facts and is labelled as AI.

One-click plain-English explanation on every finding
Grounded in the CVE, product, version and severity the scan recorded
Points you back to the vendor advisory to check it

BriefLIVE

Writes the report for leadership

Drafts the executive summary at the top of every PDF report, so the person who signs off reads a page, not a findings table.

AI-written executive summary in PDF reports
Falls back to a findings-only report if the AI is unavailable
Never claims certified, compliant or pass

DigestLIVE

Tells you within a day

Automation

One email a day to the account's owners, only when something is new: each new issue with how to fix it, and newly detected software.

Daily digest, on by default, silent when nothing changed
Email alerts on new critical and high findings
Slack and webhook alert rules for your own tooling

TriageLIVE

Decides what to fix first

Puts anything on CISA's known-exploited list at the top of your fix order, then suggests what to do with each finding and why, for a person to accept.

Fix order led by CISA's known-exploited list, not CVSS alone
Suggested next step (fix, accept risk, false positive) with its reasoning
Nothing changes until a person accepts it

ValidateROADMAP

Proves what is really exploitable

Checks whether a finding can actually be exploited on your system, with evidence, so you fix what is real first. Uses OpenAI cyber models, inside a scope you sign.

Non-destructive checks only: no data changes, no outages, no password attacks
Verified assets and a written scope you agree, nothing else
Evidence for every result, for a person to review

RemediateROADMAP

Drafts the change

Turns a finding into a ready-to-review fix: a config change, an upgrade step or a ticket, written for your stack.

Stack-specific fix drafts from detected software and version
Tickets and pull-request drafts for review, never auto-applied
Re-checks the finding on the next scan to confirm the fix

CodeLIVE

Checks the code you ship

Automation

Connect a codebase with one command from the @cyberspec/sdk package. Your dependencies are checked against known vulnerabilities, and the findings and fixes land next to your scan results.

Reads lockfiles for npm, Python, Go, Rust, Ruby, PHP, Java and .NET on your machine
Sends package names and versions only, never your source
Upgrade-to version for every vulnerable package; AI source review is on the roadmap with the Validate & Fix add-on

InsideROADMAP

Checks security from within

A lightweight agent on your own machines that checks what an external scan cannot see: patch levels, admin accounts, firewall and malware protection.

Internal checks for the controls an external scan cannot measure
Runs on machines you install it on, reports to your account only
Feeds the same findings and readiness view as external scans

Why agents, and why now

AI is helping attackers turn a published patch into a working exploit faster, sometimes within days. A team that reviews its exposure once a year, or whenever someone remembers, is working to a slower timetable than that. The agents run without anyone having to start them, and each result arrives as a plain-English next step for the person who can act on it.

The scanner does the finding, with deterministic checks, so nothing in a findings list is made up by a model. AI does the explaining, prioritising and summarising, the steps that used to need a security specialist. Read what the 2026 exploitation data shows.

What the agents will never do

Touch an asset you haven't verified you own and agreed to have scanned.
Try passwords or change anything on your systems.
Test whether a weakness is exploitable outside a scope you signed, or in any way that could change data or cause an outage. Validate is on the roadmap and only ever runs non-destructive checks.
Read your source code. Code sends package names and versions only. Source review is on the roadmap and will need its own consent for each codebase.
Present AI output without labelling it, or above the scanner's own facts.
Tell you you're certified, compliant or passing. For Cyber Essentials that is IASME and its certification bodies' call.
Replace a penetration test. A human tester finds the chained and business-logic issues automation misses.

Want the feature view instead? See every capability, or compare plans.

Start free scan