Information security
48 use cases, 16 specialists
Application security consultant
Web service security check with AI
Reads the web service's code and settings in the project folder and compiles a list of the vulnerabilities found, with severity ratings and steps to fix them.
AI consultant for a vulnerability remediation plan
Consolidates the findings of a scanner or audit report into an Excel spreadsheet with priorities, owners and remediation deadlines.
API security: an AI consultant checks the code and schema
Studies the API description and the handler code, flags weaknesses in authorization, input validation and excessive data exposure, and suggests fixes.
Application security engineer
STRIDE threat modeling for a new feature with AI
Finds the trust boundaries and data flows in a description of a new feature or a system diagram, lists the threats by STRIDE and turns them into testable security requirements.
AI assistant for setting up vulnerability scanners in a CI pipeline
Prepares configuration files for static analysis and dependency checking for the build pipeline, sets severity thresholds and helps weed out false positives.
Secure coding training for developers: an AI assistant
Creates cheat sheets and hands-on exercises on secure coding for the team's language and framework, with examples of vulnerable and fixed code.
Security architect
Threat model for an information system: an AI assistant for architects
Prepares a threat model document in Word: a system description, trust boundaries and a list of threats with risk ratings and protective measures.
AI for checking project dependencies for vulnerabilities
Goes through the project's dependency files, flags packages with known vulnerabilities and abandoned libraries, suggests versions to update to and compiles a list of components.
Information security risk assessment with AI
Consolidates the vulnerabilities and threats found into a risk register in Excel with likelihood and impact ratings and suggests layered protective measures.
Cloud security architect
Checking Terraform for security issues: an AI agent
Reads Terraform files and other infrastructure definitions, finds publicly exposed storage, excessive permissions and missing encryption, and suggests corrected snippets.
AI assistant for setting up access permissions in the cloud
Analyzes the current roles and access policies in the cloud, for example in Yandex Cloud, and proposes a scheme with the minimum necessary permissions for people and services.
Zero trust architecture with AI
Uses a description of the cloud infrastructure to draw up a scheme for network segmentation, verification of every request and data encryption, with a step-by-step transition plan.
Security compliance auditor
ISO 27001 audit preparation with AI
Compares the current security controls with the requirements of the standard and draws up a gap report and a remediation plan with priorities and deadlines.
AI for writing information security policies
Writes short, specific security policies and procedures in Word tailored to how the company is organized, with references to the clauses of the relevant standard.
Evidence collection for a PCI DSS audit: an AI agent
Sorts documents, exports and screenshots of settings by the requirements of the standard into folders and a compliance table, noting which evidence is missing.
Incident response specialist
Information security incident response plan: an AI assistant
Prepares an incident response procedure in Word: severity levels, who notifies whom, and containment and recovery steps.
AI for analyzing event logs after an incident
Reads exported event logs and reconstructs the incident timeline as a table with the time, source and indicators of compromise found.
Post-incident security report with AI
Uses the collected notes and the timeline to write a report with the root cause, the impact and three to five measures that will keep the incident from happening again.
Penetration tester
AI assistant for a penetration test report
Compiles the notes and results of an authorized test into a Word report with vulnerability descriptions, severity ratings and remediation recommendations.
Web application pentest: an AI agent for the test plan
Draws up a plan for an authorized test of a web application and API: the scope of work, the OWASP vulnerability classes to be tested and how findings are to be written up.
Verifying fixes after a pentest with AI
Checks the changes developers made to the code and settings against the findings in the report and notes which vulnerabilities are closed and which remain.
Secrets management specialist
Finding passwords and keys in code with AI
Goes through the project folder and the change history, finds passwords, keys and tokens in the code and settings, and tells real secrets apart from public values.
Key leaked into git: an AI assistant tells you what steps to take
Draws up an action plan for a leak: revoke and replace the key with the provider, check how it was used while it was exposed, clean the history and set up protection against a repeat.
AI agent for moving secrets into Vault
Finds secrets in configuration files and environment variables and prepares a plan for moving them to a secrets store with short-lived credentials and a rotation schedule.
Senior security engineer
Code security review before deployment: an AI agent
Checks code changes for hardcoded keys, insecure defaults, personal data in logs and URLs, and SQL injection, and produces a list of findings with fixes.
Setting up CORS and security headers with AI
Checks the server and application settings and prepares strict CORS rules and security headers for Nginx, with an explanation of each.
AI for securing login: JWT, cookies and rate limits
Checks the login code for mistakes with JWT and token storage and suggests storing tokens in secure cookies and rate limiting on login pages.
Threat detection engineer
AI for writing Sigma rules
Writes a detection rule in Sigma format from a description of an attack technique, with a mapping to MITRE ATT&CK, known false positives and a validation test.
MITRE ATT&CK coverage: AI analysis of detection rules
Maps the existing detection rules to the MITRE ATT&CK matrix, shows the gaps in a table and suggests the order in which to close them.
Threat hunting with an AI assistant: hypotheses and queries
Formulates hypotheses for finding hidden attacks, writes log queries and turns successful findings into repeatable procedures and new rules.
Security monitoring engineer (SOC)
Fewer false positives in SIEM: AI analysis of alerts
Analyzes an export of alerts, finds the noisiest rules and suggests exclusions, thresholds and data enrichment so that analysts see what matters.
AI agent for checking log completeness in SIEM
Compares the logs that the detection rules need with what is actually coming in and shows missing sources and gaps in the event flow.
SIEM correlation rules with AI
Writes correlation rules, tests for them and pipeline files so that the rules are kept in a repository, tested automatically and deployed to the SIEM.
Threat intelligence analyst
AI assistant for threat intelligence reports
Gathers public reports on a threat group or campaign through search and writes a report with the attackers' techniques, indicators, a confidence assessment and defensive measures.
AI for writing YARA rules
Writes YARA rules from a description and indicators taken from reports, checks their syntax and points out possible false positives.
Cyber threat overview for management with AI
Searches for recent publications about attacks on the company's industry and prepares a short summary for management with trends, risks and recommendations.
AI-generated code auditor
Checking AI-generated code for vulnerabilities
Goes through a project built with AI, finds keys in client-side code and holes in access permissions, and delivers a report with CWE numbers and fixes.
Access rights audit in Supabase and Postgres: an AI agent
Checks row-level security policies in Postgres and Supabase and finds unprotected tables, overly broad rules and roles granted through the user's own data.
Prompt injection protection: an AI audit of your code
Traces how user input gets into prompts sent to the language model, flags dangerous spots and proposes a design that separates data from instructions.
Blockchain security auditor
Smart contract audit with AI
Reviews the smart contract code line by line, runs static analysis and describes the vulnerabilities found, with an impact assessment and a fix.
AI agent for testing DeFi protocol invariants
Formulates the protocol's invariants and writes property-based tests that check the calculations at extreme values and under unusual sequences of actions.
Price oracle manipulation: an AI check of a DeFi protocol
Checks where the protocol gets its prices and whether they can be moved with a flash loan within a single block, and suggests protections: time-weighted averaging, multiple sources and deviation limits.
Identity and access management engineer
Sign-in with Yandex ID and VK ID: an AI assistant for developers
Writes and checks sign-in code using the OAuth and OpenID Connect protocols, with strict validation of redirect URIs, token lifetimes and token refresh.
Single sign-on for employees: an AI agent for setting up SSO
Helps connect single sign-on via SAML or OIDC to the corporate directory and automatically create and disable employee accounts.
Role-based access model with AI
Creates a roles and permissions matrix in Excel and the code for server-side checks, including separation of different customers' data.
Privacy engineer
Finding personal data in databases and logs with AI
Goes through database schemas, logs and exports, finds fields with personal data and compiles a register: where the data is stored, why it is collected and how long it is kept.
Deleting personal data on request: an AI agent for developers
Designs and writes code that deletes a person's data at their request across all data stores, copies and logs, with confirmation that it has been done.
Personal data anonymization with AI
Chooses an anonymization method to fit the task, whether pseudonyms, tokenization, encryption or aggregation, and writes a script that produces an anonymized copy of the data.