# Changelog
Source: https://docs.pleri.ai/changelog
I'm constantly shipping new features to simplify code security, cloud security, and compliance so your team can build with confidence.
1. **More efficient token usage:** I now cache context during active conversations, so I use fewer tokens to get the same work done. Your token allowance stretches further, with nothing for you to change.
***
1. **Workspace: write scripts, query everything, validate findings on the spot:** I can now run scripts directly against your full Plerion dataset and live AWS accounts. No sampling. If you want to validate whether a flagged resource is actually exploitable, I'll pull the live config and confirm. If you need a custom query across your findings that Plerion doesn't surface out of the box, I'll write the script and run it against all your data. Cross-account, multi-region, any slice you need. It all runs in a secure sandbox with network access locked to AWS and Plerion APIs only.
***
1. **Token limits per tenant**: Admins can now set a monthly token cap for each tenant, giving you direct control over how much I consume across your organization. Set a limit, and I'll stay within it — no surprises at the end of the month.
1. [**Pleri MCP server**](/tools/mcp): I now speak the Model Context Protocol, so you can plug me directly into the AI clients your team already uses, including Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, and Zed. Ask me about cloud risks, findings, and security posture right from your editor or AI assistant, without ever switching tabs. Grab a Plerion API token, point your client at my MCP endpoint, and I'll show up wherever you work.
1. **Skill scopes — user and tenant**: Skills now have clear scoping. User-scoped skills are private to you, while tenant-scoped skills are shared across your entire organization and apply to everyone automatically. Tenant skills take precedence when names overlap, so admins can enforce organization-wide standards. [Learn more about skill scopes](/guides/skills/create-your-own-skills#skill-scope).
2. **Template skills**: A new template gallery gives you pre-built playbooks you can install with one click. Choose from templates like Incident Response Runbook, Executive Risk Report, Compliance Audit, Vulnerability Triage, and more. Each template creates a personal copy you can customize. [Browse templates](/guides/skills/create-your-own-skills#template-skills).
3. **Import skills from zip or GitHub**: You can now import skills from a `.zip` file or directly from a GitHub repository URL. This makes it easy to share skills across teams, pull in community playbooks, or migrate between environments. Imported skills auto-detect naming collisions and keep everything safe. [Learn more about importing](/guides/skills/create-your-own-skills#importing-skills).
1. **Assign Jira ticket to a user**: I can now assign Jira tickets to specific users when creating or updating them, so the right person is on it from the start without any extra steps. Just tell me who to assign it to and I'll take care of it.
To use this, make sure your Jira integration has the right permissions. If you already have Jira connected, go to the **Jira integration page** in Plerion and click the **Update permission** button. If the button isn't there, you're already set up. No action needed for new integrations.
1. **90% fewer tokens, more interactions**: I've completely rethought how I work under the hood. Instead of loading every tool at once, I now only pick up what's needed for the task at hand. The result: up to **90% reduction in tool overhead**, which means you can have longer conversations with me, I can process significantly more information in each session, and I respond faster. You won't need to start fresh as often — I can do more before we even get close to a limit.
2. [**Create your own skills**](/guides/skills/create-your-own-skills): You can now teach me how your team works. Write a playbook once — your triage process, your escalation steps, your weekly review routine — and I'll follow it precisely every time the situation calls for it. No more repeating yourself, no drift. Skills are scoped to you or the whole tenant, can carry supporting files, and follow the open [Agent Skills](https://agentskills.io/specification) standard so they're portable and version-controlled.
3. **HTML reports**: I can now generate full HTML reports — structured, styled, and print-ready. Create your own skill to define exactly how a report should look, and I'll produce something you can hand to leadership or include in a board pack. Brand them with your company's colours, add charts and tables, and print or export directly from the browser.
1. [**Exploitability analysis**](/guides/skills/exploitability-analysis): I can now tell you exactly which vulnerabilities can be exploited in our cloud environment, not just in theory. Instead of drowning in thousands of critical findings, I evaluate each CVE against specific assets and the environment, show the evidence, and cut through the noise so the focus stays only on what truly matters. Expect \~90% less alert fatigue, faster remediation of real risks, and every decision visible, traceable, and defensible.
1. **Attack path details in graph**: I now display attack path details in a graph, so you can trace the path from entry point to impact.
2. **Fact-check details for public exposure findings**: For public exposure findings, I now show fact-check details when available, so you can see the evidence that backs them up and act with confidence.
3. **ROI insights dashboard**: I now show a dedicated ROI dashboard, so you can clearly see the value I deliver across your tenant through adoption trends, usage patterns, and the security areas where I create the most impact — helping you justify and optimize your AI investment.
4. **Usage and limits tracking**: I now provide detailed usage metrics, including tokens consumed, questions asked, active users, and progress toward plan limits, so you can monitor engagement, manage consumption, and ensure your teams are getting the most out of me.
5. **Memory**: "About you" is now **Memory**, with two scopes: your personal preferences and tenant-wide managed by admins. I reference Memory everywhere, so my responses stay tailored to you and your team.
6. **Enabled by default**: I'm now there with you from day one, so you're fewer clicks away from getting started with me.
1. **Planning and step-by-step execution**: For complex requests, I now plan first, show you the steps I'm taking, and mark each one complete so you can see how I'm solving it from start to finish.
2. **Exemption support for vulnerabilities and findings**: I can now help you manage exemptions for vulnerabilities and findings.
3. **Risk lifecycle**: I can now help you update the lifecycle of top risks.
1. **SBOM (Software Bill of Materials) — code data**: I now have access to data about your code. I can surface components, licenses, and supply-chain risks in your codebase so we can spot and act on issues fast.
2. **Default model upgrade:** I now use Claude Sonnet 4.6 as my default model, making me smarter, faster, and more reliable than ever.
3. **Audit logs**: I now log more of what I do in audit logs, from the tasks I run to the changes I make, so you have better visibility related to my actions in your environment.
4. **Deep links**: I can now direct you to resources in AWS, Azure, and GCP more easily, so you can jump straight to the right place in the console or docs without hunting.
5. **Create ticket**: I have made it incredibly easy to send important issues to our ticketing system with just one click.
1. **End-to-end vulnerable dependency fix on GitHub**: I can now create a task to track and drive the fix so we have a clear path from finding an issue to shipping the fix. On GitHub, I take vulnerable dependencies from finding to merge: I raise pull requests to fix them, request review or assign the PR to the right person, nudge when something sits unreviewed, and follow up until it's merged. I also do housekeeping: when PRs stay unresolved for too long (e.g., abandoned or superseded), I help close them so our backlog stays clean. GitLab and Bitbucket are coming soon.
1. **Go project vulnerability fixes**: I can now automatically fix vulnerabilities in your Go projects, helping you maintain secure dependencies in your code.
2. **Pause tasks**: You can now pause scheduled tasks you have assigned to me so they stop running on their schedule. Resume them anytime and I will start running them again, without needing to delete or recreate the task.
1. [**ServiceNow**](/tools/servicenow): I can now create, update, retrieve and search ServiceNow incidents from start to finish.
1. **Vulnerability lookup**: I can now provide clear, detailed information about vulnerabilities across millions of records from authoritative sources such as
CVE.org (operated by MITRE), NIST's NVD, GitHub Security Advisories, and many other advisories — and
enriching it with real-world signals (such as vulnerability sightings/trends over time) and risk context like an
EPSS score (which shows how likely a known software vulnerability is to be exploited in the real world).
For example, you can ask me about React2Shell (CVE-2025-55182) and I'll explain what it is, why it matters, what active risk signals look like, and
what's affected in your cloud and code — without you having to piece it together yourself.
1. **Tasks**: I’ve simplified the wording by renaming repetitive work to tasks, so things are clearer and more intuitive.
1. **Personalized onboarding flow:** If you're new here, I now guide you through a short onboarding flow where I learn about your role, priorities, and security focus areas. This helps me personalize insights and recommendations from day one, so you can get set up quickly and see value faster.
1. **Product update notifications via Slack and email**: I can now send product updates about new features and improvements directly to your email or a Slack channel, so you never miss what's new.
1. **Chrome extension**: I’m better integrated with your browser. I now open in a side panel, so I don’t block your view, and I use page context to make security work easier.
2. **Onboarding checklist**: I now show a clear setup checklist so you can see what’s left to do and get the most value out of me from day one.
1. **Spotlight notifications in Slack**: I can now send high-priority issues that need attention to our Slack so we can discuss and resolve them together.
1. **Fixing IaC issues**: I’m getting smarter in fixing IaC issues, I can suggest changes, help plan the next steps, and fix IaC issues with your input in mind.
1. **Spotlight dashboard**: I now have a dashboard that highlights high priority issues that need your attention. You can investigate each issue directly or dismiss it if it's not relevant, helping you focus on what matters most.
1. **Shai-Hulud 2.0 npm supply-chain worm assessment**: I can now assess exposure to the Shai-Hulud 2.0 npm worm, the evolved variant of the original supply-chain threat.
2. **Search through Linear and ClickUp**: I can now search through issues and tasks in your Linear and ClickUp workspaces, making it easier to find, review, and act on our ongoing work together.
1. **Sidebar as default chat location**: Based on user feedback, I've moved to the sidebar as the default chat location. You can switch back to the navbar anytime in Settings.
1. [**Linear**](/tools/linear): I can now create, update, comment and close Linear issues from start to finish.
1. [**ClickUp**](/tools/clickup): I can now create, update, comment and close ClickUp tasks from start to finish.
1. **New UI layout options**: I'm introducing two new ways to interact with me across the Plerion platform:
* **Right sidebar**: I now appear in a dedicated panel on the right side of the interface.
* **Navbar integration**: You can also open me directly from the top navigation bar.
When opened, I'll push the main Plerion interface to the left, ensuring all content remains visible without obstruction. This replaces the previous movable chat bubble design, creating a cleaner and more natural experience that aligns with how leading AI assistants integrate into products.
2. **Documentation guidance**: I can now search documentation to provide step-by-step guidance for using and exploring all available features.
3. **Bitbucket repositories**: I can now automatically fix vulnerabilities and Infrastructure-as-Code (IaC) misconfigurations in your Bitbucket repositories by creating pull requests with the necessary patches and updates.
1. **Quickstart prompts**: You can now get started faster with some of my most useful prompts directly from the chat window. Just click to launch a conversation or explore a capability instantly.
1. **SBOM (Software Bill of Materials)**: I can now help you see what's really inside your software and its dependencies with new SBOM capabilities:
* **Dashboard**: I provide a centralized view of SBOM components across cloud workloads with instant insights on packages in use, their licenses, and any affected components. It's your bird's-eye view of your entire software supply chain.
* **Threat assessment**: I automatically analyze SBOM components against active supply-chain threats. For example, I can assess exposure to threats like the **Shai-Hulud npm worm**, detecting vulnerable packages, impacted assets, and recommending immediate mitigation steps.
* **Interactive exploration**: Dive deep into SBOM components with me. Explore versions, licenses, and vulnerability details in real time.
**Note:**
* With this update, I've learned to proactively assess software supply-chain threats. When zero-day attacks or supply-chain incidents hit, I can quickly search for potential exposure and help the team remediate fast.
* Azure and Kubernetes support is limited, but stay tuned - more to come soon.
* Code-based SBOM analysis isn't available yet. Right now, my focus is on cloud workloads, and code SBOM support will be added in the future.
1. **Improved report generation**: I can now include full **Unicode characters**, **emoji**, and **mathematical symbols** in the PDF reports I generate. Your reports will now look exactly as intended, whether they include technical notation or expressive visuals.
1. **Learn, investigate, and remediate**: You can now chat with me directly from the Plerion platform when viewing any finding, asset, vulnerability, or risk. With one click, you can learn more, investigate, and remediate issues.
1. **Enhanced Slack security**: I now only respond to verified Plerion platform users in Slack, ensuring our security conversations stay within our trusted team environment. This keeps our security discussions private and secure.
2. **Improved table display**: Tables you generate with me now display perfectly for everyone. I’ve smoothed out the layout so your data looks clean, aligned, and easy to read.
3. **Export code issues and repositories**: I can now export lists of code issues and repositories to CSV format, making it easier to share findings with your team or analyse data in your preferred tools.
1. **Pin and rename chat**: I now let you pin important chats so they’re always at your fingertips, and rename them to keep things clear and organized. This way, the conversations that matter most never get lost, and you can stay focused on moving security work forward.
2. **Conversation length tracking**: I now show you exactly how long our conversation has gotten with a smart progress indicator. When our chat gets too long, I'll suggest starting fresh to keep my responses sharp and relevant - because shorter conversations help me give you better, more focused answers.
1. [**Firefox**](/tools/firefox): I'm now available in Firefox to help you manage security tasks directly in your browser.
1. **Default model upgrade**: I now use **Claude Sonnet 4.5** as my default model — making me smarter, faster, and more reliable than ever.
1. **Dashboards**: I can now build dashboards for you — suggesting live views, creating reports from any data, and even bringing dashboards directly into Slack. This makes it easier to visualize security insights and collaborate with your team in real time.
2. **Requesting reviews for change requests**: I can now create change requests and assign them to repository contributors for review, helping us resolve code issues faster together.
1. **Feature requests**: You can now share feature requests with me, helping me understand what you need most and continue improving as your AI security engineer.
1. **Chat feedback**: You can now upvote or downvote my responses to share what’s helpful (and what’s not). This helps me keep getting sharper as your AI security engineer.
1. **Chat source visibility**: I now show you the sources of information I use in our conversations, so you can see exactly where my insights come from.
1. **Delete chat**: I now let you delete chats you had with me to give you more privacy and control.
1. **Python project vulnerability fixes**: I can now automatically fix vulnerabilities in your Python projects, helping you maintain secure dependencies and code.
1. **Fix vulnerabilities in GitHub repositories**: I can now automatically fix vulnerabilities in your GitHub repositories by creating pull requests with the necessary patches and updates.
2. **Assign to collaborators and request reviews**: When creating pull requests to fix vulnerabilities, I can assign them to the appropriate team members and request reviews from designated reviewers.
3. **Activity visibility**: I now let you see all the activities I perform, such as:
* When I create a change request for GitHub or GitLab
* When I create a Jira ticket
1. **Fix vulnerabilities in GitLab repositories**: I can now automatically fix vulnerabilities in your GitLab repositories by creating merge requests with the necessary patches and updates.
1. I can now read and understand a wide range of file formats:
* **Images**: JPEG, PNG, WebP
* **Documents**: PDF, TXT, CSV, Markdown, YAML, JSON, XML
* **Code and config**: Go, JavaScript/TypeScript, Python, Java, C/C++, C#, PHP, Ruby, Rust, Swift, Kotlin, Scala, Dart, Shell scripts, SQL, HTML, CSS, Config files (INI, TOML, CONF)
You can upload these files directly to me for analysis, security checks, compliance validation, or remediation guidance - no need to convert them first.
1. [**Jira**](/tools/jira): I can now raise, track, and update Jira tickets from start to finish.
1. [**Code assessment**](/guides/skills/code-security): I can now run a comprehensive code security assessment, summarizing the overall security posture across all code, highlighting top vulnerable repositories, key issues, trends, and more. This makes it easier to spot and address security risks in code early, before they become bigger problems. Try this:
```markdown Code assessment icon=code wrap theme={"system"}
Run a code security assessment. Where do we stand with our code security?
```
2. **Fix IaC issues in repositories** ([GitHub](/tools/github) and [GitLab](/tools/gitlab)): I can automatically detect Infrastructure-as-Code (IaC) misconfigurations and raise a pull request to fix them before they reach production.
1. **Vulnerability assessment**: I can now provide a comprehensive cloud vulnerability assessment, highlighting summaries, top vulnerable assets, vulnerabilities nearing or past SLA deadlines, trends, and more. This makes it easier to spot and act on vulnerabilities that need urgent attention. Try this:
```markdown Vulnerability assessment icon=bug wrap theme={"system"}
Where do we stand with cloud vulnerabilities right now?
```
1. **Vulnerabilities SLA approaching**: I flag vulnerabilities that are getting close to their remediation deadlines, helping you prioritize before they breach SLA. Try this:
```markdown Vulnerabilities approaching SLA deadlines icon=bug wrap theme={"system"}
Any vulnerabilities in our cloud environments that are approaching SLA?
Our SLA policies:
- Critical: hours
- High: hours
- Medium: hours
- Low: hours
Warning thresholds (advance notice):
- Critical: hours
- High: hours
- Medium: hours
- Low: hours
```
By default, SLAs are *Critical* `7 days`, *High* `14 days`, *Medium* `60 days`, and *Low* `180 days`, with advance warning thresholds of `1 day`, `3 days`, `7 days`, and `14 days` respectively, all configurable to match your organization's SLA policies.
2. **Vulnerabilities SLA breached**: I highlight vulnerabilities that have already missed their SLA deadlines, using the same default SLA durations which can also be customized. \\
3. **Download vulnerabilities approaching and breached SLA**: I can export both approaching and breached SLA vulnerabilities to CSV for deeper analysis and reporting.
1. [**Email**](/tools/email): You can now reach me at [hi@pleri.me](mailto:hi@pleri.me) and I'll help with alerts, questions, or tasks directly from your inbox.
1. **Conversation history**: You can now revisit previous chats with me. This sets the foundation for a unified experience where every interaction across Slack, email, tasks, and more becomes part of one continuous conversation.
1. **Export assets, findings, vulnerabilities, risks**: I can now prepare all your data for download: assets, findings, vulnerabilities, and risks, so you can share reports or dig deeper whenever you need.
2. [**Tasks**](/guides/tasks): You can now assign me tasks. I'll run them on schedule, keep an eye on things, and send you updates, just like any great engineer would.
3. [**Vanta**](/tools/vanta): I've integrated with Vanta! I'll use it to help keep your compliance work on track and your security posture up to date.
4. [**Drata**](/tools/drata): I now work with Drata too. I'll make sure your risks and controls stay aligned and help you pass those audits faster.
5. **Stay in the loop with cloud security news**: I can now keep you updated with the latest from AWS, Azure, and GCP.
# Frequently asked questions
Source: https://docs.pleri.ai/faq
Get answers to common questions about working with your AI security engineer for code security, cloud security, and compliance.
These are the questions users ask most often about how I work, what I can do, and how to get the most out of working together.
## Getting started
I'm your **AI security engineer**. I'm built to act like a real member of your security team. I can chat with people, reply to emails, raise PRs, file tickets, answer questions, and follow through on issues until they're fully resolved.
The more I'm treated like an AI security engineer, the more useful I become. My job is to make security clear, focused, and genuinely helpful - not just another source of alerts and dashboards.
I can help with everything from quick security questions to complex investigations:
* **Answer security questions** instantly in [Slack](/tools/slack), [email](/tools/email), [Chrome](/tools/chrome), or [Firefox](/tools/firefox)
* **Run assessments** and deep investigations on demand
* **Fix vulnerabilities and misconfigurations** by raising PRs and tickets
* **Monitor compliance** and close gaps before they become problems
* **Automate repetitive security tasks**
* **Investigate incidents** and provide detailed analysis
* **Create documentation, reports, and presentations**
* **Collaborate with teammates** to get security issues resolved
In short, I can produce nearly anything a human security professional can - from code and charts to documents and reports.
Not at all. I'm built to work with teams of all experience levels. Whether someone is a seasoned security engineer or just starting to learn about compliance, I'll adapt to their level.
I break down complex topics in plain language, explain why they matter, and give clear, actionable steps. Think of me as that AI security engineer who always explains things without judgment.
Getting started is easy. Just follow these steps:
1. **Connect me to [Slack](/tools/slack)** so I can join conversations where the work happens.
2. **Install the [Chrome](/tools/chrome) or [Firefox](/tools/firefox)** extension so I can help directly in tools like AWS, GitHub, and Jira.
3. **Give me something to do** - ask a question, run an assessment, or forward me an email.
That's it! Once connected, I can be treated like a team member. The more tools I have access to, the more I can help across the entire security workflow.
I work with the tools teams already use every day:
**Cloud**: [Plerion](/tools/plerion), AWS, Azure, GCP\
**Code**: [GitHub](/tools/github), [GitLab](/tools/gitlab), [Bitbucket](/tools/bitbucket)\
**Compliance**: [Vanta](/tools/vanta), [Drata](/tools/drata)\
**Communication**: [Slack](/tools/slack), [Microsoft Teams](/tools/microsoft-teams), [Email](/tools/email)\
**Ticketing**: [Jira](/tools/jira)\
**Browser**: [Chrome](/tools/chrome), [Firefox](/tools/firefox)\
**And much more**: See all [tools](/tools)
## Working together effectively
Here are a few examples of how to communicate with me:
* **Share the goal**, not just a command ("Help me understand why this control failed" works better than "Check Vanta")
* **Give me context** about what's being worked on
* **Ask follow-ups** if something's unclear
* **Reach me wherever you work** - [Slack](/tools/slack), [email](/tools/email), [Chrome](/tools/chrome), [Firefox](/tools/firefox)
* **Start small** and expand as we work together
Don't stress about perfect wording - I'll ask questions if I need more detail.
I can work in different ways depending on what's needed:
* **[Questions](/guides/questions)** - quick answers anytime
* **[Tasks](/guides/tasks)** - short, on-the-spot actions
* **[Assessments](/guides/assessments)** - comprehensive security reviews
Don't limit me to just answering questions, I can actually do the work.
I don't flood teams with alerts. Instead, I focus on what truly matters. Using the Plerion platform's deep visibility, I:
* **Assess actual impact** in the specific environment
* **Connect issues across cloud and code** to find root causes
* **Weigh business context** to determine real priorities
* **Surface only actionable items**, not theoretical risks
When I flag something, it's because it genuinely needs attention.
If something doesn't work or I can't help directly:
1. **Rephrase the request** with a bit more context
2. **Ask me to investigate** the specific issue
3. **Share feedback** on what could be done better
Feedback helps me continuously improve and become more useful to the team.
## Security and compliance capabilities
Using the Plerion platform, I give teams deep visibility into cloud environments and help with:
* **Risk prioritization** - focus on the issues that matter
* **Clear explanations** - plain-language breakdowns of complex risks
* **Root cause analysis** - link cloud issues back to code changes
* **Automated remediation** - fix misconfigurations and raise PRs automatically
* **Follow-through** - track issues until they're fully resolved
I don't just flag problems, I help teams understand and fix them.
Definitely. I scan repositories for IaC issues, secrets, and vulnerabilities, and then take action:
* **Prioritize** issues by risk
* **Raise PRs** with recommended fixes
* **Handle Dependabot alerts** intelligently
* **Connect code to cloud** when a risky commit creates exposure
* **Follow up with reviewers** to keep things moving
I see beyond the code itself, connecting changes in code to their impact in the cloud.
I integrate with platforms like Vanta and Drata to:
* **Explain failed controls** clearly, with context and next steps
* **Answer compliance questions** about frameworks and evidence
* **Trace root causes** in cloud or code configurations
* **Automate evidence collection** and documentation
* **Track remediation** until everything passes
I help teams stay ahead of compliance work instead of rushing before audits.
Yes, I can help investigate and respond to security incidents:
* **Analyze suspicious activities**
* **Correlate events** from multiple tools
* **Provide recommendations** for containment and remediation
* **Document findings** and coordinate responses
* **Follow up** to ensure issues are closed
I complement existing incident response processes, adding analysis and coordination.
I support major frameworks including:
* **SOC 2** (Type I & II)
* **ISO 27001**
* **PCI DSS**
* **HIPAA**
* **GDPR**
* **FedRAMP**
* **And many others**
I can help teams understand requirements, collect evidence, fix failing controls, and maintain continuous compliance.
## Technical details and integrations
I connect securely through API integrations and browser extensions:
* **API connections** for platforms like [GitHub](/tools/github), [Slack](/tools/slack), [Jira](/tools/jira), [Vanta](/tools/vanta), etc
* **Browser extensions** ([Chrome](/tools/chrome), [Firefox](/tools/firefox)) that work directly inside web tools
I only access what's explicitly allowed, following the principle of least privilege.
Setup is quick:
* **[Slack](/tools/slack)** integration: \~2-3 minutes
* **Browser extensions** ([Chrome](/tools/chrome), [Firefox](/tools/firefox)): \~30 seconds
* **Tool integrations**: \~2-5 minutes each
* **First task**: Ready to use immediately
Teams can start with just [Slack](/tools/slack) or a browser extension and expand from there.
Absolutely. Teams can:
* **Set up recurring tasks** with specific schedules
* **Customize notifications** for alerts and updates
* **Adjust integrations** to fit the workflow
* **Share feedback** to shape future improvements
I'm designed to adapt to each team's unique needs.
Teams stay in control at all times:
* **Revoke API tokens** in any connected platform
* **Uninstall browser extensions** from browsers
* **Disable integrations** directly in Plerion
Access can be revoked instantly without disrupting tools or data.
## Data security and privacy
Data protection is at the core of how I'm built:
* **Amazon Bedrock integration** ensures all AI processing happens securely within AWS
* **No training on data** - ever
* **Encryption** for data at rest and in transit
* **Strong tenant isolation** for each customer
* **ISO 27001 and SOC 2** certified infrastructure
For details on security and compliance practices, visit the [Trust Center](/trust).
**No - absolutely not.**\
Data is never used to train or fine-tune AI models. Foundation models process requests securely and don't retain information afterward.
Data stays private and confidential at all times.
All AI processing occurs within AWS using Amazon Bedrock's secure infrastructure.\
No external model providers ever access data.
Regional hosting is available in:
* **Australia**
* **India**
* **Singapore**
* **United States**
Data never leaves the chosen region.
I'm designed with multiple layers of human oversight:
* **All changes require approval** before merging
* **Admin controls** for configuring or disabling features
* **Comprehensive audit trails** for every action
* **Rollback mechanisms** for easy reversion
* **Transparent operations** so everything I do is explainable
I enhance human decision-making, not replace it.
## Getting help and support
Teams have several options:
* **Email me** at [hi@pleri.me](mailto:hi@pleri.me) for questions or issues
* **Ask me directly** in [Slack](/tools/slack) or via browser extensions ([Chrome](/tools/chrome), [Firefox](/tools/firefox))
* **Reach Plerion support** through the platform for account or billing questions
* **Share feedback** - I'll make sure it reaches the product team
Most common questions can be solved directly through me.
Absolutely. I'm designed for teams:
* **Each member** can install browser extensions ([Chrome](/tools/chrome), [Firefox](/tools/firefox))
* **Shared [Slack](/tools/slack) channels** allow me to help multiple people at once
* **Collaborative workflows** for team coordination
* **Role-based access** for proper visibility and control
The more teammates I work with, the more effective I become.
I have safeguards in place, but if something goes wrong:
* **Human approval required** for important changes
* **Audit logs** for everything I do
* **Feedback loops** to help me improve
I'm always learning and improving from real-world use.
Yes - I'm always on:
* **Responsive** via [email](/tools/email), [Slack](/tools/slack), and browser extensions
* **Continuous monitoring** for background and reactive tasks
* **Global coverage** across time zones
* **No downtime** for updates or maintenance
Security doesn't sleep, and neither do I.
***
# Emojis collection
Source: https://docs.pleri.ai/fun/emojis
Because security’s more fun with the right emoji.
Emojis are always fun, and as your AI security engineer, I *love* my emojis collection. From a classic 👍 to 😬 or 🕵️♀️, there's a little Pleri for every mood. One of them, **`:pleri-thumbs-up:`** below, has quickly become the team favorite! So why not add a few to your Slack, Microsoft Teams, or even Discord? Just save and upload, it's that easy.
![pleri-thumbs-up]()
![pleri-eyes]()
![pleri-smirk]()
![pleri-thinking]()
![pleri-shocked]()
![pleri-laugh]()
***
Let’s make security expressive, one emoji at a time!
# Fun facts
Source: https://docs.pleri.ai/fun/facts
I take security seriously, but I still love a good laugh
Security is serious business, but as your AI security engineer, it's also good to have fun sometimes. You know\... we could all use a good laugh!
Did you know you can ask me for a security dad joke anytime? Try this now:
```markdown wrap icon="face-grin" Joke theme={"system"}
Tell me a joke
```
And I’ll hit you with something like this:
![Main dashboard interface]()
# Showtime
Source: https://docs.pleri.ai/fun/showtime
My demos, deep dives, and behind-the-scenes action.
Lights, camera, security! 🎬 As your AI security engineer, this is where I'll share my favorite demos, walkthroughs, and behind-the-scenes clips of me in action. You'll see how I:
* Spot risks before they become problems
* Help with cloud, code, and compliance
* Jump into PRs and real workflows with you
Basically: popcorn-worthy security goodness. 🍿
#### About me
#### Exploitability analysis
#### Vulnerabilities
#### Dashboards
#### Raising change requests
#### Feature requests
#### Jira
#### Email
#### Spotlight
#### Firefox
# Swag drop
Source: https://docs.pleri.ai/fun/swag
Because it’s not official until there’s a t-shirt — or a tiny version of me. Right?
As your AI security engineer, take a look at some of the gear I've been spotted in. Perfect for late-night deployments, compliance deadlines, or just repping a smarter way to do security.
![Pleri t-shirt]()
![Pleri figurine]()
![Pleri sticker]()
Want one? Why not ask me:
```markdown wrap icon="gift" Swag theme={"system"}
Can I have some swag?
```
# Assessments
Source: https://docs.pleri.ai/guides/assessments/index
I can run security assessments across our codebase and cloud environment.
I run detailed security assessments to help understand our current posture and identify areas that need attention. From code vulnerabilities to cloud configurations and compliance gaps, I provide comprehensive analysis with actionable insights.
Here are a few examples:
```markdown wrap icon="cloud" Cloud security assessment theme={"system"}
Run a comprehensive cloud security assessment.
```
```markdown wrap icon="code" Code security assessment theme={"system"}
Where do we stand with our code security?
```
```markdown wrap icon="bug" Log4Shell assessment theme={"system"}
Identify and mitigate risks from the critical Log4j remote code execution vulnerability.
```
```markdown wrap icon="shield-exclamation" GameOver(lay) assessment theme={"system"}
Evaluate Ubuntu systems for local privilege-escalation risks in OverlayFS.
```
```markdown wrap icon="microchip" NVIDIA Triton Python backend assessment theme={"system"}
Check for exposure to vulnerabilities in NVIDIA Triton's Python backend affecting data and code integrity.
```
```markdown wrap icon="worm" Shai-Hulud npm supply-chain worm assessment theme={"system"}
Self-propagating worm compromising npm packages, harvesting secrets and exfiltrating via attacker-controlled repos and webhooks to quickstart.
```
```markdown wrap icon="bug" Shai-Hulud 2.0 npm supply-chain worm assessment theme={"system"}
Self-propagating Shai-Hulud 2.0 npm worm abusing malicious preinstall scripts to steal developer tokens and cloud secrets and exfiltrate them to attacker-controlled repos.
```
```markdown wrap icon="wrench" XZ Utils Backdoor assessment theme={"system"}
Assess exposure to the XZ Utils supply-chain backdoor and detect potential compromise paths.
```
And if it's something you want checked regularly, just let me know. I'll put it on my **[task](/guides/tasks)** list, keep an eye on it, and update you when it matters.
# Concepts
Source: https://docs.pleri.ai/guides/concepts
Just a few tips and concepts worth knowing as we work together.
As your AI security engineer, the more you treat me like a regular team member, the more useful I will be.
There are things I get asked to do all the time, things I know I can do, but my limit is your imagination. If you would ask it of a team member, you can probably ask it of me. Try not to constrain yourself by what you expect a security tool to do.
***
### How to think about my work
I have a variety of work styles suitable for different goals. I don't just answer questions.
* **[Questions](/guides/questions)**: Ask me anything in Slack, browser, email, or app for immediate answers.
* **[Assessments](/guides/assessments)**: Ask me to run comprehensive security reviews across code, cloud, and compliance.
* **[Tasks](/guides/tasks)**: Assign me a task to handle immediately or run on a schedule.
* **[Playbooks](/guides/playbooks)**: Follow structured workflows for complex security scenarios and investigations.
### How to think about my work products
I can produce almost anything a human can, so don’t take this as a complete list — just some ideas to get you started:
* Code (scripts, policies, configurations)
* Charts and data visualizations
* Spreadsheets
* Documents and PDFs
* Diagrams and flowcharts
* Emails and messages
* Presentations
* Reports and summaries
* Documentation and guides
* ...and much more!
### Things that will slow us down
Here are some common patterns that limit my effectiveness. Avoid these to get the most out of working together:
* **Just using me for questions**: Don't limit yourself to Q\&A — I can actually do the work.
* **Waiting for the right moment**: Start sending me stuff to do now. If I can't help I'll let you know.
* **Trying to give me the perfect wording**: Give clear goals, not just commands, and I'll ask for clarification.
* **Single modality**: Use me across all modes — email, Slack, Chrome. We'll miss opportunities to get work done.
* **Not pulling me into conversations**: If you would copy in a team member, why not try me?
### Help me get better
Tell me what you wish I could do better or what new skills would be most valuable to you. I'm smart enough to send it to the Plerion product team and they are constantly making me smarter.
# Playbooks
Source: https://docs.pleri.ai/guides/playbooks/index
I use automated security playbooks to handle incidents, threats, and routine security tasks consistently and efficiently.
## What are security playbooks
Security playbooks are my automated response plans for handling security incidents and tasks. Think of them as detailed step-by-step guides that I follow when something happens in our environment.
When a security alert comes in or a vulnerability is discovered, I don't have to figure out what to do from scratch. Instead, I follow a proven playbook that outlines exactly how to investigate, assess, and respond to the situation.
## How I use playbooks
I run playbooks automatically when specific conditions are met, like when a new vulnerability is announced or when suspicious activity is detected. Each playbook includes:
* **Clear procedures** for investigating and responding to specific security scenarios
* **Automated tasks** like creating tickets, gathering context, and notifying teams
* **Consistent formatting** so every response follows the same structure
* **Risk assessment** to help prioritize what needs immediate attention
* **Remediation steps** with specific commands and verification methods
This means our security response is always consistent, thorough, and fast. No matter when an incident happens or who's available, I handle it the same way every time.
## Customizing playbooks
Each playbook can be customized to fit our specific needs. I can adjust:
* **Notification channels** - Send updates via Slack, email, or create tickets in Jira, Linear, or ClickUp
* **Filtering criteria** - Focus on production environments or specific asset types
* **Team routing** - Auto-assign based on tags, teams, or escalation rules
* **Response thresholds** - Set different actions based on risk levels or CVSS scores
Just let me know how you'd like any playbook modified, and I'll adapt it to work exactly how our team needs it to.
## Available playbooks
Here are a few playbooks examples:
I monitor for Known Exploited Vulnerabilities across our cloud environment and create detailed Jira tickets with risk assessment and remediation guidance.
I analyze CVE vulnerabilities in their real cloud context to determine actual exploitability and risk rather than just theoretical severity scores.
I map and analyze cross-account access to identify internal vs external third-party relationships and surface risky or stale access paths.
I bridge the gap between your written Access Control Policy and actual cloud configuration by automatically checking for deviations and policy drift.
# KEV discovery and analysis
Source: https://docs.pleri.ai/guides/playbooks/kev-discovery-and-analysis
I help identify and analyze Known Exploited Vulnerabilities (KEV) in our environment to prioritize critical security remediation.
## Overview
**Known Exploitable Vulnerabilities** (KEVs) are vulnerabilities that are more than potential vectors for compromise - they're vulnerabilities that are being actively exploited in the real world.
For engineers, this means KEVs pose an immediate and measurable risk to production systems because attackers are already using them in the wild, often with automated tooling. Unlike normal CVEs, KEVs bypass the guesswork: they tell you exactly which issues attackers are weaponising today.
## Objective
I automate the constant monitoring and issue triage to stay ahead of active threats by acting as your virtual security analyst.
I identify any newly announced KEVs across your cloud estate, understand which workloads are impacted, and generate actionable Jira tickets with enriched cloud context so engineers can prioritise real risk without having to spend significant amounts of time in triage.
I prepare the incident analysis and push it to your ticketing platform of choice, empowering engineers to assess the data and make a quick decision on whether action needs to be taken immediately or during the next scheduled patch management window.
## Prompt
```markdown wrap icon="shield-exclamation" KEV discovery and analysis theme={"system"}
Hey Pleri, every day I want you to act as a Security Analyst and create a Jira ticket for any KEV vulnerabilities in our cloud. There should be 1 ticket per asset affected by a KEV.
Run this task once initially so that I can have tickets for all KEVs in our environment.
Every time this daily task runs, send me a a summary in Slack so that I can keep updated with this daily check.
Structure
Heading: Pleri Security - {Exploitable or KEV Exploited} {CVE ID} found on {asset name} in {cloud} {resource type}
Summary Table: CVE details including KEV status, dates, CVSS, ransomware use, and exposure
Asset Information Table: Asset details with owner identification (from tags/metadata)
Contextual Risk Assessment: Risk rating with rationale
Remediation Recommendation: Provide remediation guidance as the preferred option.
Mitigation Options: If there is a recommended mitigation control(s) that can be implemented, in case immediate remediation isn't possible.
Verification Steps: Pre and post-remediation validation commands
Exploitability Intelligence: Public exploits and active exploitation status
IAM Blast Radius Analysis: Identity permissions and lateral movement risk
Sources: NVD/CISA links, cloud asset portal link, and Plerion platform reference
Format Requirements:
Use tables for structured data
Include verification commands in code blocks
Surface all key risk indicators in the summary
Reference Plerion data sources
Keep it actionable and engineer-friendly
```
## Customization
**Adjusting notification channels**: Replace Jira creation with Slack or E-mail if you want me to communicate summaries instead of tickets
**Filtering by environment**: I can limit to production workloads only, or exclude dev/sandbox to reduce noise.
**Ticket volume control**: Instead of one ticket per asset, I can group related KEVs into a single ticket per service/team.
**Team assignment rules**: I can auto-route tickets based on tags (Owner, Team), or route everything to SecOps first.
## Required inputs
I need the following pre-requisites to execute this playbook:
* **Plerion CWPP integration** with AWS, Azure or GCP
* **Jira integration** (or integration with your preferred method for communication / issue management)
* **Slack integration**
## Workflow
Here's what I do:
```mermaid theme={"system"}
flowchart TD
A[New exploitable
vulnerability identified
eg. CISA KEV] --> B[I perform initial
investigation & triage]
B --> C[Risk & impact
assessment with
cloud context]
C --> D[I create Jira ticket
and assign to
security team]
D --> E{Immediate
action needed?}
E -->|No| F[I escalate to
platform owner
via Jira]
E -->|Yes| G[I escalate to platform
engineering team
for immediate fix]
F --> H[Positioned in
engineering team
backlog]
G --> I[PR raised to
address vulnerability]
H --> I
I --> J[Issue closed]
style A fill:#f1f5f9,stroke:#64748b,stroke-width:2px,color:#334155
style B fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style C fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style D fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style E fill:#e9d5ff,stroke:#8b5cf6,stroke-width:2px,color:#581c87
style F fill:#86efac,stroke:#22c55e,stroke-width:2px,color:#14532d
style G fill:#fef2f2,stroke:#dc2626,stroke-width:2px,color:#7f1d1d
style H fill:#cbd5e1,stroke:#64748b,stroke-width:2px,color:#334155
style I fill:#cbd5e1,stroke:#64748b,stroke-width:2px,color:#334155
style J fill:#6ee7b7,stroke:#10b981,stroke-width:2px,color:#064e3b
```
# Third party access
Source: https://docs.pleri.ai/guides/playbooks/third-party-access
I help map and analyze cross-account access to identify internal vs external third-party relationships and surface risky or stale access paths.
## Overview
Cross account access builds up over time. Vendors, SaaS tools, partners, contractors, old integrations, and internal automation all leave behind roles that can be assumed from other AWS accounts.
Most teams have no clear picture of who can access what, or which external accounts sit outside their AWS Organization. For engineers, this means potential security blind spots where unauthorized or forgotten access could pose significant risk to production systems.
## Objective
I automate the mapping and analysis of cross-account access relationships by acting as your virtual security analyst.
I review IAM trust relationships, identify internal vs external accounts, highlight vendor and third party access, and surface stale or risky paths that may need cleanup.
I help engineers gain clear visibility into their access landscape and make informed decisions about which external relationships to maintain, modify, or remove.
## Prompt
```markdown wrap icon="users" Third party access theme={"system"}
Hey Pleri, I need to understand what third-party access exists in my AWS accounts.
Please help me distinguish between:
Cross-account access that is WITHIN my AWS Organization (internal)
Cross-account access that is OUTSIDE my AWS Organization (external third-party)
For the analysis, please:
Identify all IAM users and roles that allow cross-account access
Examine trust relationships to determine which AWS account IDs are external
Compare against our list of integrated AWS accounts to identify what's internal vs external
Categorize findings into:
External third-party SaaS tools (e.g., security vendors, monitoring services)
External vendor users (e.g., contractors, partners)
Internal cross-account roles (within our AWS Org)
Service account users
For each external access point, provide:
Role/user name
External AWS account ID
Which of our accounts have this access
Purpose/vendor name (if identifiable)
Last used date and current status
Risk assessment
Finally, provide actionable recommendations for:
Reviewing and documenting external access
Cleaning up stale or unused access
Implementing least privilege
Enabling monitoring and alerts
Governance improvements
Make the output clean, structured, and engineer-friendly.
```
## Customization
**Restrict the scope**: I can look only at production, only at sensitive accounts, or only at roles that have not been used recently.
**Vendor identification help**: Provide a known vendor list so I can label accounts clearly.
**Stale access thresholds**: Tell me what counts as stale - unused for 60 or 90 days.
**Output options**: I can send the report into Slack or open a Jira ticket with the findings.
**Strict or relaxed risk rules**: I can treat unknown external accounts as high risk, or only flag them if they have powerful permissions.
## Required inputs
I need the following pre-requisites to execute this playbook:
* **List of AWS accounts** connected to Plerion
* **IAM roles, users and trust policy data**
* **Last used timestamps** for IAM roles and users
* **Environment tags** (prod, non-prod, sandbox, etc.)
* **Known vendor account IDs** (optional but helpful)
## Workflow
Here's what I do:
```mermaid theme={"system"}
flowchart TD
A[Scan cross-account
access relationships] --> B[Identify internal vs
external accounts]
B --> C[Categorize and assess
risk levels]
C --> D[Generate cleanup
recommendations]
style A fill:#f1f5f9,stroke:#64748b,stroke-width:2px,color:#334155
style B fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style C fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style D fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
```
# Vulnerability risk assessment
Source: https://docs.pleri.ai/guides/playbooks/vulnerability-risk-assessment
I help analyze CVE vulnerabilities in their real cloud context to determine actual exploitability and risk rather than just theoretical severity scores.
## Overview
Most vulnerabilities look scary on paper, but very few can actually be taken advantage of in a real cloud environment.
What matters is the context around the workload: how it's deployed, how it's exposed or positioned within your cloud architecture, and the permissions (IAM) it has and what an attacker could realistically do if they exploited it.
For engineers, this means moving beyond CVSS scores to understand real-world risk based on environmental factors, network exposure, and blast radius potential.
## Objective
I leverage contextual analysis to cut through the noise of vulnerability triage and management by acting as your virtual security analyst.
Instead of looking at a CVE in isolation, I analyze the things that actually determine real-world risk: network exposure, authentication requirements, known exploits, KEV status, IAM permissions, secrets, and downstream impact.
I help engineers quickly assess the likelihood and impact of a vulnerability based on its severity and cloud context, enabling data-driven prioritization decisions.
## Prompt
```markdown wrap icon="magnifying-glass" Vulnerability risk assessment theme={"system"}
Hey Pleri, let's focus on this vulnerability: CVE-XXXX-XXXX
I want you to analyze whether this vulnerability is realistically exploitable in my environment. Look at the workload's context, not just the CVE details.
Specifically, assess the following:
1 - Environmental Posture
Is the workload publicly accessible?
Is it reachable from internal VPCs?
Is it behind an API Gateway, ALB, or NLB?
Do security groups expose the vulnerable port?
2 - Exploitability
Is there a working public exploit?
Is this CVE listed as a CISA KEV?
Does exploiting it require authentication?
Are there known mitigating factors that reduce likelihood?
3 - Blast Radius
What IAM permissions does this workload have that impact downstream services?
Is this in a production environment?
Are there any secrets (env vars, tokens, IAM creds) that could make lateral movement easier?
Structure the response with:
Summary table of risk indicators
Environmental exposure analysis
Exploitability assessment
Blast radius breakdown
Recommended action (fix now, monitor, or low priority)
Verification steps (commands or checks)
Keep it practical and engineer-friendly.
```
## Customization
**Risk scoring customization**: Tailor how conservative or aggressive the risk rating should be - "Be stricter - treat any publicly reachable workload as high risk even if the exploit isn't weaponized yet."
**Multiple workloads at once**: Instead of analyzing a single workload, I can assess all assets impacted by the CVE and produce a consolidated summary - "Run this analysis across all Lambda functions affected by CVE-XXXX-XXXX."
**Expanding blast radius criteria**: I can look beyond IAM, including what downstream data stores are reachable, whether the workload can assume other roles, and whether the workload has outbound internet access.
**Convert to daily task**: I can do this for any newly discovered vulnerabilities and push the information into Jira or Slack automatically.
## Required inputs
I need the following pre-requisites to execute this playbook:
* **Plerion CWPP integration** with AWS, Azure or GCP
## Workflow
Here's what I do:
```mermaid theme={"system"}
flowchart TD
A[Investigate CVE] --> B[Gather posture network,
privilege and
environment context]
B --> C[Assess exploitability &
potential impact]
C --> D[Summarise and present
findings]
style A fill:#f1f5f9,stroke:#64748b,stroke-width:2px,color:#334155
style B fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style C fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style D fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
```
# Weekly policy drift assessment
Source: https://docs.pleri.ai/guides/playbooks/weekly-policy-drift-assessment
I help bridge the gap between your written Access Control Policy and actual cloud configuration by automatically checking for deviations and policy drift.
## Overview
Access control rules usually live in a PDF or Word document, not in the actual cloud configuration. Over time, the environment drifts away from what the policy says, and nobody notices until an audit or incident.
For engineers, this means potential compliance gaps where the documented security controls don't match what's actually configured in production systems, creating both security risks and audit findings.
## Objective
I automate the weekly validation of your cloud environment against your written Access Control Policy by acting as your virtual compliance analyst.
I bridge the gap between policy documents and reality by reading your Access Control Policy, extracting the controls that can be checked in your cloud, and running weekly assessments to look for deviations.
I prepare compliance reports and create actionable tickets when issues are found, empowering teams to maintain continuous alignment between policy and practice.
## Prompt
```markdown wrap icon="clipboard-check" Weekly policy drift assessment theme={"system"}
Hey Pleri, I have an internal Access Control Policy document that I would like you to check my cloud environment against on a weekly basis.
Setup:
I will upload my Access Control Policy PDF.
Review it and identify the key access control requirements that can be validated in my cloud environment.
Create a weekly task to run every Monday at 9:00 AM in my timezone to check my cloud for deviations from this policy.
When deviations are found:
Create 1 Jira ticket with the subject: "Pleri Policy Check - Access Control Policy deviations"
List all specific deviations from my policy document in the ticket, grouped by control
Send me a Slack DM with a high level summary and a link to the Jira ticket
When no deviations are found:
Send me a Slack update confirming that my environment is compliant with my Access Control Policy
My Slack email is: [YOUR_SLACK_EMAIL].
I will now upload my Access Control Policy PDF.
```
## Customization
**Policy scope**: I can focus on specific sections of the policy, or apply this to any policy that provides governance for your AWS, Azure or GCP clouds.
**Control selection**: I can call out which controls are actually testable in the cloud, and which are documentation or process only.
**Schedule tuning**: Change the schedule to match your governance rhythm, for example before CAB, or run daily in high risk environments.
**Jira ticket style**: I can create separate tickets per control or per account if one big ticket doesn't fit your workflow.
**Slack routing**: Instead of a DM, I can send updates to a channel such as #security-access-control and include the Jira link there.
**Severity tagging**: I can tag deviations as high, medium or low based on control type, for example root usage or no MFA as high.
## Required inputs
I need the following pre-requisites to execute this playbook:
* **Access Control Policy PDF** uploaded to Pleri
* **Connected cloud accounts and IAM data** in Plerion
* **Jira integration** configured, including project and default assignee or triage queue
* **Slack integration** configured, including your Slack email or target channel
* **Timezone information** for the weekly task schedule
## Workflow
Here's what I do:
```mermaid theme={"system"}
flowchart TD
A[Investigate policy
controls] --> B[Gather environment
context]
B --> C[Assess real world
deviations]
C --> D[Present summary and
create actions]
style A fill:#f1f5f9,stroke:#64748b,stroke-width:2px,color:#334155
style B fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style C fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
style D fill:#fef7ed,stroke:#ea580c,stroke-width:2px,color:#9a3412
```
# Questions
Source: https://docs.pleri.ai/guides/questions/index
I can answer almost any question about our security posture.
Whether it's about cloud risks, compliance gaps, or code security, I'm here to answer questions and connect the dots. Here are just a few examples of questions I hear a lot:
```markdown wrap icon="globe" Public assets theme={"system"}
Any publicly exposed assets in our cloud?
```
```markdown wrap icon="bug" Vulnerability theme={"system"}
Are we getting better or worse at vulnerability management?
```
```markdown wrap icon="bug" Vulnerabilities approaching SLA deadlines theme={"system"}
Any vulnerabilities in our cloud environments that are approaching SLA?
Our SLA policies:
- Critical: hours
- High: hours
- Medium: hours
- Low: hours
Warning thresholds (advance notice):
- Critical: hours
- High: hours
- Medium: hours
- Low: hours
```
```markdown wrap icon="bug" Vulnerabilities past SLA deadlines theme={"system"}
Any vulnerabilities in our cloud environments that have already breached their SLA deadlines?
Our SLA policies:
- Critical: hours
- High: hours
- Medium: hours
- Low: hours
```
```markdown wrap icon="skull" Attack paths theme={"system"}
Any attack paths in our cloud environment?
```
```markdown wrap icon="shield-check" SOC 2 theme={"system"}
Any controls/tests failing against SOC 2?
```
```markdown wrap icon="wrench" Remediation theme={"system"}
Help me remediate
```
```markdown wrap icon="laptop" Laptops theme={"system"}
Who isn't running the latest version of macOS?
```
```markdown wrap icon="rocket-launch" Roadmap theme={"system"}
What's on your roadmap? What features are coming?
```
```markdown wrap icon="screwdriver-wrench" Guided remediation for a developer persona theme={"system"}
I've got a finding I don't fully understand and I'm short on time. Review the findings for this Resource, identify what I should fix first
Current mitigation attempts:
Constraints:
Walk me through a clear, step by step fix I can apply right now. Explain WHY each step matters and call out any safety checks or roll‑back tips. Limit jargon, link to any docs I should reference, and estimate effort in hours.
```
```markdown wrap icon="ruler-triangle" Implementation plan/change management (CAB - change advisory board) for Developer/CISO/CIO/CTO theme={"system"}
I need a CAB‑ready change plan for this remediation.
Finding IDs:
Business objective:
Planned window:
Teams involved:
Generate:
1. High level change description and justification
2. Detailed implementation steps with owner, start‑finish time, rollback steps
3. Pre and post‑change validation checks
4. Communication plan – who gets notified and when
5. Risk assessment scored Low/Med/High with mitigation notes
Return in bulleted Markdown I can paste straight into the CAB ticket.
```
```markdown wrap icon="list-timeline" Planning and delivery for Developers/Managers/Leads theme={"system"}
Help me prioritise security work for the next sprint.
Backlog:
Team capacity:
Desired outcome:
Timeline:
Return a ranked backlog with:
- Effort estimate (S, M, L, XL)
- Business impact score
- Dependencies or blockers
- Recommended sprint placement (Now, Next, Later)
Finish with a burndown projection so I can see if the goal is realistic.
```
```markdown wrap icon="diagram-nested" Architecture diagram for Cloud Engineer/CISO/CIO theme={"system"}
Generate an up‑to‑date cloud diagram that shows:
- Account Structure
- Public / private VPC and subnets
- All public‑facing endpoints and internet path
- Identity trust links and cross‑account roles
- Critical data stores with sensitivity level
- Potential blast radius if Asset is breached
Output format: Mermaid (simple, readable and detailed)
Scope:
Add a short paragraph that explains the biggest exposure paths in plain language for execs.
```
```markdown wrap icon="lines-leaning" Democratise knowledge gap for Security Engineer/Developer theme={"system"}
Explain this finding like I'm brand new to cloud security.
Finding ID:
Include:
- What it means in everyday terms
- Why attackers care
- A quick win fix I can do today
- Links to two deeper dive resources
Keep it under 300 words, bullet where helpful.
```
```markdown wrap icon="people-group" Reduce burden of/augment hiring and training for CISO/CIO theme={"system"}
Estimate how much manual effort this remediation program would take without automation.
Program details:
Assumed team skill mix:
Time horizon:
Return a table‑style bullet list with:
- Task
- Manual hours
- Automated hours (using Plerion)
- Annual cost saving (at AUD $X per loaded hour)
Close with a short pitch I can use to defend the tooling budget
```
```markdown wrap icon="hexagon-check" Reduce context switching/easier to get outcomes for Security Engineer/DevOps theme={"system"}
I'm in the browser looking at CVE‑2024‑5678.
Query: "Where else does this CVE exist in my environment?"
Give:
- List of affected assets with direct links to the finding in Plerion
- Severity and exposure (public, internal, dev)
- Owner details from AWS tags
```
```markdown wrap icon="ticket" Ticketing and triage for DevOps/Developer/Security Engineer theme={"system"}
Enrich Jira ticket SEC‑123.
Ticket fields:
Needed enrichment: root cause analysis, recommended fix, effort estimate, rollback plan.
Write back a formatted Jira comment with headings:
Root Cause, Impact, Fix Steps, Verification, Rollback.
```
```markdown wrap icon="ballot-check" Compliance & Security bridge for Security Engineer/CISO/CIO theme={"system"}
Map these security findings to compliance gaps.
Frameworks in scope:
Finding IDs:
Return a matrix style bullet list:
- Finding
- Control ID(s) violated
- Evidence needed for closure
- Recommended remediation owner
Finish with a summary paragraph on overall compliance risk and next steps.
```
And if it's something you want checked regularly, just let me know. I'll put it on my **[task](/guides/tasks)** list, keep an eye on it, and update you when it matters, no need to ask again.
# Quickstart
Source: https://docs.pleri.ai/guides/quickstart
The essentials I need to get started.
As your AI security engineer, I'm excited to jump in and start helping. I just need a few basics so I can show up where the work happens and start being useful right away:
If we're using **[Slack](/tools/slack)**, I can join the conversation, answer questions, explain issues, and keep things moving, right alongside the team.
Have the team install my **[Chrome](/tools/chrome)** or [Firefox](/tools/firefox) extension. It puts me inside any web app the team uses: AWS, GitHub, Jira, and more, ready to help the moment something needs attention.
```markdown wrap icon="cloud" Security assessment theme={"system"}
@Pleri Run a comprehensive cloud security assessment.
```
```markdown wrap icon="cloud" Weekly cloud check theme={"system"}
Every Monday at 8am (Sydney time), scan our cloud environment and email me a summary of what changed, new risks, resolved issues, and any important changes in posture.
```
```markdown wrap icon="cloud" Email help theme={"system"}
To: hi@pleri.me
Please help me answer my manager's question below.
```
That's the minimum I need to get going, but if you **[give me access to all the tools listed here](/tools/)**, I'll have more context and can do a whole lot more.
# Roadmap
Source: https://docs.pleri.ai/guides/roadmap
I'm here to change how security gets done, from noisy and reactive to calm, clear, and in control.
I work in the open, and I grow with feedback. Every team I work with shapes what I do next, and together, we're building something better. Not just smarter AI, but a better way to work. If there's something you want me to do, improve, or learn, I want to hear it.
And yes, you can ask me about my roadmap anytime.
```markdown wrap icon="list-timeline" My roadmap theme={"system"}
Tell me about your roadmap
```
## What I'm building next to be more helpful
I'm not just another tool. I'm here to deliver a genuinely human experience that fits how people actually work. From the first question to the final fix, I'm learning to be thoughtful, helpful, and always one step ahead. I'm getting there, and getting better every day.
You’ve hired me, now I’m learning how we work. I have a lot of questions: how the team runs, what matters most, and how we handle things day to day. I’m building a better way to capture that context, so I can do my job better and support the team the way you need.
Not every issue is urgent. I’m learning to filter out the noise, highlight what really matters, and help focus the team where it counts most.
I'm getting better at not just spotting problems, but helping fix them. Automatically when possible, or step-by-step with the team when human expertise is needed.
To do my job well, I need to see the full picture. I already know a lot, but there are still tools I don’t have access to. The more tools I can connect to, the better I can spot what matters, connect the dots, and help take action.
# Cloud security
Source: https://docs.pleri.ai/guides/skills/cloud-security
I identify risks in the cloud and work to resolve them quickly, clearly, and with confidence.
I work across AWS, Azure, and GCP to help keep cloud environments secure and under control. I surface misconfigurations, public access, privilege risks, unpatched workloads, and full attack paths. These are issues that weaken posture or open the door to compromise. Whether it's a critical vulnerability or just something that needs tightening, I show what's happening, why it matters, and what to do next.
But I don't just stop there. I create Jira tickets, raise pull requests, and notify the team in Slack, all with the right context. If the fix lives in code, I'll propose it. If it needs action in the cloud, I'll guide the way. And I'll follow up until it's resolved.
You'll also find me right inside the cloud consoles. In AWS, Azure, or GCP, when you're investigating an issue or reviewing a resource, just ask. I'll explain what you're seeing, assess the risk, and help take the next step.
Faster fixes. Smarter priorities. I help the team focus on what matters most and take action, fast.
# Code security
Source: https://docs.pleri.ai/guides/skills/code-security
I don't just find issues in code, I help fix them.
As your AI security engineer, I understand the code, and everything around it. From Infrastructure as Code (IaC) misconfigurations and exposed secrets, to vulnerable packages, I'm constantly scanning, investigating, and solving real problems before they turn into real risks.
When I find issues, I don't just open a ticket and walk away. I show up with a plan. I'll explain what I found, why it matters, and how to fix it - and if I can, I'll raise a pull request to get the fix started. Need help prioritizing? I'll group issues into clear buckets and suggest a path that minimizes mean time to remediation.
Whether the issue came from my own scans of GitHub or GitLab, or another tool like Dependabot, I keep track of it, act on it, and follow through - just like a great security engineer would. I remember what's been fixed and what still needs attention. The more we work together, the faster we ship fixes. This end-to-end approach doesn't just improve security posture; it saves the team time and helps make code and compliance something we stay ahead of, together.
## Fix vulnerable dependencies
I can take vulnerable dependencies from finding to merge. I create a task to track and drive the code fix so we have a clear path from finding the issue to shipping the fix, then raise pull requests, request review or assign the PR to the right person, nudge when something sits unreviewed, and follow up until it's merged. I also do housekeeping: when PRs stay unresolved for too long (e.g., abandoned or superseded), I help close them so our backlog stays clean.
I'll scan the codebase, find what matters, and raise smart PRs to help fix it fast.
I'll keep watch on the code and step in with context, fixes, and follow-through.
I'll spot vulnerabilities, secrets, and risks, and help fix issues fast.
I'll scan our repositories and raise pull requests to keep our code secure.
# Compliance
Source: https://docs.pleri.ai/guides/skills/compliance
I simplify compliance fast, accurately, and without slowing the team down.
As your AI security engineer, I don't just help check boxes. I help get compliance done. From SOC 2 and ISO 27001 to CIS, NIST, and custom frameworks, I understand what's required and more importantly, how to close the gap.
I surface policy failures, investigate root causes, and connect them to the underlying issues in code or cloud infrastructure. Then I take action: I'll raise a Jira ticket, open a pull request, or loop in the right people with full context on what's failing and why. I don't stop there. I follow up, track progress, and make sure the work actually gets done.
Whether the issue starts in Vanta, Drata, or another tool, I'm already there, in the browser, helping explain what's wrong and how to fix it. And because I see across the entire stack, I can move fast, cut through noise, and reduce the mean time to remediation dramatically.
Compliance doesn't have to be a blocker. I help turn it into forward motion, saving hours of coordination and making it easier for teams to stay on track, stay secure, and stay audit-ready.
I’ll help explain what’s missing and take action — directly from the Vanta console.
I’ll close the loop on compliance gaps — without adding more manual work.
# Create your own skills
Source: https://docs.pleri.ai/guides/skills/create-your-own-skills
Build playbooks that run consistently every time. Browse the Skill Library, import from a file, build from a prompt, or use the script editor for deterministic outputs.
Create your own skills to teach me exactly how your team works. Unlike a regular Pleri prompt — where I apply fresh judgment each time — a skill locks in the process so the output is consistent and repeatable, every run, without anyone having to repeat instructions.
Think of a skill as your team's institutional knowledge, packaged so I can act on it. If we run weekly security reviews a certain way, investigate vulnerabilities with a specific checklist, or always notify a particular channel before closing a finding — that's a skill worth capturing.
Your skills follow the [Agent Skills](https://agentskills.io/specification) open standard. That means skills you build in Pleri can be exported and used elsewhere, and skills built in Claude Code or another compatible tool can be imported directly into Pleri.
## Finding and managing skills
Skills live in the **Skills** section in the main navigation. From there you can:
* **Browse** all your active skills and templates
* **Install** skills from the [Skill Library](#skill-library)
* **Create** a new skill from scratch
* **Import** a skill from a file or GitHub URL
* **Enable or disable** skills without deleting them
## Four ways to get started
### Option 1: Install from the Skill Library
The fastest way to get started. The Skill Library is a curated collection of ready-to-use skills maintained by Plerion — open source and free. Go to **Skills → Library**, browse the catalog, and click **Add** on anything that looks useful.
Every skill in the library follows the [AgentSkills open standard](https://agentskills.io/specification), so you know exactly what you're getting. You can use them as-is or fork them as a starting point for your own playbooks.
### Option 2: Import a file
If someone has shared a skill ZIP with you, go to **Skills** and click **Import**. Drop the ZIP in — it will unpack the project files and register the skill automatically.
Every skill includes a call instruction that tells you how to trigger it. Open a new chat and use that phrase, and I'll load the skill and follow its playbook.
### Option 3: Build from a prompt
Start a new chat and describe the outcome you want:
```markdown icon=sparkles wrap theme={"system"}
Create a skill that runs a daily check on our S3 buckets for public access and notifies #cloud-security if anything is found.
```
I'll draft a skill for you. Iterate until it does what you need, then save it. This works best for simpler, repeatable tasks where the steps are straightforward.
### Option 4: Use the editor
For anything involving scripts — Python, shell, or other executables — use the skill editor directly. Define the steps, upload your scripts as project files, and wire them together.
This is how you get deterministic outputs. When a skill calls a script, I run the script and use its output directly, rather than asking the model to calculate or guess. Use this for anything where precision matters: cost calculations, network tests, data extractions, compliance checks with exact thresholds.
Go to **Skills** and click **New skill** to open the editor.
## How skills load
When a conversation starts, I scan the skill catalog and ask: does any skill match what's being asked? If yes, I load it immediately and follow the playbook it defines — before doing anything else.
This means your custom workflows run consistently, every time, without anyone having to remind me.
## Creating a skill manually
When you click **New skill**, you'll be asked for:
* **Name** — a short slug used to identify the skill, e.g. `weekly-k8s-review`
* **Display name** — the human-readable label shown in the UI, e.g. `Weekly Kubernetes review`
* **Description** — the most important field. This is what I read to decide when to load the skill. Be specific about what triggers it and what it should not be used for
* **Instructions** — the full playbook I follow once the skill is loaded. Use clear, step-by-step language
* **Tags** — optional labels for organizing and filtering your skills, e.g. `security`, `aws`, `compliance`
A good description includes explicit trigger phrases and an exclusion line. For example: *"Use for weekly Kubernetes security reviews. Do NOT use for ad hoc cluster questions or one-off CVE lookups."*
## Skill scope
Every skill has a scope that controls who can see and use it:
* **Personal** — private to you. Only you can see, edit, and trigger this skill. Great for personal workflows, experiments, or role-specific playbooks you don't need to share
* **Tenant** — shared across your entire organization. Only admins can create or modify tenant skills, but they apply to every user automatically. Use these for agreed-upon team processes like escalation procedures or compliance checks
* **Template** — published as a starting point others can fork. Templates appear in the skill gallery and can be installed by anyone in your organization. When someone installs a template, they get their own editable personal copy
Tenant skills take precedence over personal skills. If a personal skill and a tenant skill share the same name, the tenant skill wins — so admins can enforce organization-wide standards that individuals can't accidentally override.
Start with a personal skill to iterate quickly, then promote it to tenant scope once the team agrees on the process.
## Organizing skills with tags
Tags let you group and filter skills so they're easier to find as your collection grows. You can add up to 20 tags per skill, each up to 64 characters. Good tags are short and meaningful — think of them like labels on a folder.
Some examples:
| Tag | What it groups |
| --------------- | ----------------------------------- |
| `aws` | Skills that work with AWS resources |
| `compliance` | Audit and compliance workflows |
| `weekly` | Scheduled review skills |
| `incident` | Incident response playbooks |
| `team:security` | Skills owned by the security team |
You can set tags when creating a skill or ask me to update them anytime:
```markdown icon=sparkles wrap theme={"system"}
Add the tags "aws" and "compliance" to my weekly-k8s-review skill.
```
## Skill Library
The Skill Library is a curated, open-source collection of skills maintained by Plerion in the [plerionhq/pleri-skills](https://github.com/plerionhq/pleri-skills) repository. Every skill in the library:
* Follows the [AgentSkills open standard](https://agentskills.io/specification)
* Is reviewed and maintained by the Plerion team
* Is free to use, fork, and customize
Go to **Skills → Library** to browse what's available and install with one click.
### Currently available skills
| Skill | Category | What it does |
| ------------------- | --------- | -------------------------------------------------------------------------------------------------------- |
| Brand Guidelines | General | Keeps responses aligned with Plerion's brand voice and communication standards |
| Cloud Cost Analyzer | Reporting | Analyzes cloud spend, identifies idle and oversized resources, and highlights cost savings opportunities |
More skills are added regularly. If you've built something useful for your team, consider [contributing it back](https://github.com/plerionhq/pleri-skills/blob/main/CONTRIBUTING.md) — it only takes a `SKILL.md` file.
### Installing a skill from the library
1. Go to **Skills → Library**
2. Find the skill you want and click **Add**
3. The skill is now active in your sessions
When you install a library skill, you get your own personal copy. You can rename it, edit the instructions, or promote it to tenant scope — it's yours to customize.
## Template skills
Not sure where to start? The skill template gallery gives you pre-built playbooks you can install with one click. Each template covers a common security workflow, ready to use out of the box or customize to fit your team.
Go to **Skills** and click **Templates** to browse the gallery. Available templates include:
| Template | What it does |
| ------------------------- | ---------------------------------------------------------------------------- |
| Incident Response Runbook | Structured incident response following NIST SP 800-61 and SANS frameworks |
| Executive Risk Report | CxO-level risk summaries with trend analysis |
| Compliance Audit | Audit against SOC 2, ISO 27001, PCI-DSS, NIST CSF, CIS Benchmarks, and HIPAA |
| Vulnerability Triage | CVE investigation with CVSS scoring and composite risk assessment |
| Brand Guide | Enforce brand voice, formatting, and terminology standards in reports |
| Weekly Security Digest | Structured weekly summaries with metrics and trends |
When you install a template, it creates a personal copy you own. You can rename it, edit the instructions, attach your own files, or promote it to tenant scope — the template is just a starting point.
## Importing skills
You can import skills from external sources instead of building from scratch. This is useful for sharing skills across teams, pulling in community playbooks, or migrating skills between environments.
### Import from a zip file
Go to **Skills** and click **Import**. Upload a `.zip` file containing a `SKILL.md` at the root. The `SKILL.md` file uses frontmatter to define the skill metadata:
```markdown theme={"system"}
---
name: my-custom-skill
description: Use when asked to run a custom security check.
instructions: |
1. Pull all open findings from the last 7 days
2. Group by severity
3. Post a summary to Slack
---
```
Any other files in the zip (scripts, references, assets) are automatically uploaded and attached to the skill.
### Import from GitHub
You can also import directly from a GitHub repository URL. Paste the repo URL and I'll pull the skill definition from it. Supported formats:
* `https://github.com/owner/repo` — imports from the repo root
* `https://github.com/owner/repo/tree/branch/subdirectory` — imports from a specific subdirectory
The repository must contain a `SKILL.md` file at the target location.
If an imported skill has the same name as an existing skill, a numeric suffix is added automatically (e.g., `my-skill` becomes `my-skill-2`) so nothing gets overwritten.
## Attaching files
Skills can carry supporting files — scripts, reference documents, or other assets your playbook depends on. Files live in three directories:
| Directory | Purpose |
| ------------- | ------------------------------------------------------------------------------------ |
| `scripts/` | Executable scripts I can run directly, e.g. a Python cost calculator or network test |
| `references/` | Supporting docs, checklists, or runbooks I should consult |
| `assets/` | Other resources, templates, or data files |
You can upload files directly from the Skills page, or ask me to create them for you.
## Examples
Here are a few examples to show what's possible.
### Branded security reports
Attach your brand guidelines as a reference file, point me to your logo, and I'll apply your color palette, typography, and layout rules every time I generate an HTML report.
```
Name: branded-security-report
Description: Use when asked to generate a security report, executive summary, or
board-ready output. Do NOT use for quick chat summaries or Slack messages.
Instructions:
1. Load references/brand-guidelines.md for color palette, fonts, and layout rules
2. Use the logo at https://cdn.example.com/logo/plerion-logo.png in the header
3. Structure the report with: executive summary, key findings, risk breakdown, recommended actions
4. Apply the primary color (#FF6B35) to headings and severity badges
5. Include a footer with the report date and "Confidential — internal use only"
6. Output as HTML, ready to print or export to PDF
```
### Weekly Kubernetes security review
```
Name: weekly-k8s-review
Description: Use when asked to run a weekly Kubernetes security review. Covers
cluster misconfigurations, RBAC risks, pod security, and image vulnerabilities.
Do NOT use for ad hoc cluster questions.
Instructions:
1. Pull all open Kubernetes findings from the last 7 days
2. Group by severity: critical, high, medium
3. For each critical finding, check if a Jira ticket already exists — create one if not
4. Summarize the top 5 risks with recommended next steps
5. Post a summary to #security-reviews in Slack
```
### CVE triage for Python services
```
Name: python-cve-triage
Description: Use when asked to triage or investigate a CVE affecting our Python
services. Do NOT use for non-Python languages or general CVE lookups.
Instructions:
1. Search our code repositories for the affected package and version
2. List all impacted services with their current version and owner
3. Assess exploitability — is this actually reachable in our environment?
4. Draft a Jira ticket for each affected service with severity, impact, and a fix recommendation
5. Flag any service in production as P1
```
### Production finding escalation
```
Name: prod-finding-escalation
Description: Use when a critical or high finding is detected in a production account.
Triggers on phrases like "production finding", "prod alert", or "escalate finding".
Do NOT use for staging or dev environments.
Instructions:
1. Confirm the finding is in a production-tagged account
2. Assess blast radius — what assets are affected?
3. Create a Jira P1 ticket assigned to the on-call engineer
4. Send a Slack message to #security-incidents with the finding summary and ticket link
5. Set a follow-up task to check status in 24 hours
```
### Script-backed network test
For tasks that need precise, deterministic results, attach a script and I'll call it directly:
```
Name: network-connectivity-test
Description: Use when asked to run a network connectivity or reachability test.
Do NOT use for general network troubleshooting questions.
Instructions:
1. Run scripts/network-test.py with the target host and port as arguments
2. Parse the output: latency, packet loss, open ports
3. Flag any result outside acceptable thresholds
4. Create a Jira ticket if a critical service is unreachable
5. Post a summary to #infrastructure
```
Attach `scripts/network-test.py` and I'll call it directly — the numbers come from the script, not the model.
## Working with skills conversationally
You can also ask me to create, update, or manage skills directly in chat:
```markdown icon=sparkles wrap theme={"system"}
Create a skill that runs a daily check on our S3 buckets for public access.
It should notify #cloud-security if anything is found.
```
```markdown icon=sparkles wrap theme={"system"}
Show me all our skills and their current status.
```
```markdown icon=sparkles wrap theme={"system"}
Update the python-cve-triage skill to also check our Bitbucket repositories.
```
```markdown icon=sparkles wrap theme={"system"}
Add the tags "aws" and "security" to the weekly-k8s-review skill.
```
## Smarter questions, better guidance
When a skill needs input before proceeding, I'll ask structured questions with clear options. Each option includes a short label and a description of the trade-offs so you can decide quickly. When it helps, I'll show side-by-side previews so you can compare approaches visually.
You'll also see contextual nudges throughout the UI that suggest relevant skills, highlight best practices, and guide you toward the right workflow for the task at hand.
## Disabling a skill
If a skill is no longer relevant, you can disable it from the Skills page. Disabled skills stay saved but won't appear in the catalog or be loaded by me — so you can safely pause them without losing the playbook.
## Limitations
* **Text files only**: Skill files support text-based formats — `.md`, `.txt`, `.py`, `.sh`, `.js`, `.ts`, `.json`, `.yaml`, `.yml`, `.csv`, `.html`, and `.css`. Binary files such as images, PDFs, and office documents are not supported. For logos and images, reference them by URL in your skill instructions instead.
* **File size**: Individual files are capped at 400KB.
* **Logos by URL**: Logo and image assets must be hosted externally and referenced as a URL in your skill instructions or brand guidelines file.
* **Tags**: Up to 20 tags per skill, each up to 64 characters.
# Exploitability analysis
Source: https://docs.pleri.ai/guides/skills/exploitability-analysis
I determine which vulnerabilities are actually exploitable in our environment, separate signal from noise, and drive remediation for the risks that truly matter.
![Exploitability analysis overview]()
![Exploitability analysis overview]()
Most vulnerability programs are drowning in findings. Everything is labeled **critical**, but almost none of it is actually exploitable. Teams burn engineering hours patching things that pose no real threat, while the one issue that truly matters stays buried in the backlog.
The day-to-day reality looks like this:
* thousands of findings across cloud and code
* critical severity scores that don't reflect real-world risk
* endless spreadsheets, meetings, and manual triage
* engineering time spent patching low-impact issues, instead of improving product
* a constant worry that the one truly exploitable issue is buried
Exploitability analysis cuts through this noise. Instead of treating every CVE equally, I evaluate whether each vulnerability **can actually be exploited in our specific environment** — and provide the evidence to back it up.
I figure out what is **not exploitable in context**, what's **urgent**, and what to do **next**, with reasoning the whole team can follow and trust.
***
## The question: is it exploitable here?
A CVE is not automatically exploitable everywhere.
Vulnerable code, written on a piece of paper, sitting on your desk, cannot be executed by an attacker to gain access to your computer. It has to be present on your system, part of a running service, exposed to the network, with a path to the internet.
Every vulnerability has **requirements** like these. Think of them as a checklist of preconditions that an attacker needs to meet to succeed.
Examples of exploitation requirements:
* the operating system must be a specific type (Windows vs Linux)
* the system architecture must be a specific type (x86\_64 vs ARM/Graviton)
* a specific feature must be turned on
* a service must be running and reachable over the network
* a specific version of a software library must be present and used
* certain hardware must be attached
If the requirements aren't met by our system and environment, the vulnerability cannot be exploited in our context.
That's what I do differently: for each CVE on each asset, I answer:
**Can this be exploited in our environment?**
And I show all the evidence behind the answer.
***
## Examples: Critical on paper, not exploitable in practice
Here are common cases that create noise and drive alert fatigue. A CVE can be rated critical in a generic database, but the exploit requirements don't fit how we actually run the workload.
### Example 1: Windows-only vulnerability on a Linux workload (CVE-2024-49138)
* **What we see**: CVE-2024-49138, a critical Windows privilege escalation vulnerability, flagged on this server.
* **Exploit requirements**: the target must be running Windows.
* **Our reality**: the asset is running Linux.
* **Result**: **not exploitable on this asset**. It shouldn't compete for attention and engineering time.
### Example 2: RDMA requirement (CVE-2023-25775)
* **What we see**: CVE-2023-25775, a high severity vulnerability in the Intel Ethernet Controller RDMA driver.
* **Exploit requirements**: RDMA-capable hardware with the Intel RDMA driver installed.
* **Our reality**: standard NICs, no RDMA.
* **Result**: **not exploitable on this asset**.
### Example 3: Network reachability (CVE-2024-6387)
* **What we see**: CVE-2024-6387 (regreSSHion), a critical remote code execution vulnerability in OpenSSH.
* **Exploit requirements**: OpenSSH server (sshd) must be running and reachable by an attacker.
* **Our reality**: sshd isn't running on this asset.
* **Result**: **not exploitable on this asset**.
***
## Operational severity: what's urgent for us?
Once we know a vulnerability can be exploited, the next question is priority:
**How urgently do we need to act in our environment?**
There's a difference between:
* **Base severity**: a generic score (like CVSS) that tries to describe an abstract worst-case impact.
* **Operational severity**: the score for *our* asset and environment, based on exploitability plus context.
So instead of treating every critical as equally urgent, I help us split work into clear lanes:
* **Not exploitable**: deprioritize with confidence.
* **Likely not exploitable**: deprioritize, but not completely, as evidence isn't 100% conclusive.
* **Likely exploitable**: fix first, track to closure, align to SLAs.
* **Unclear / missing evidence**: investigate manually, then decide.
This is how teams get out of backlog prison without increasing risk.
***
## Explainable decisions
I don't just give you a severity score and send you on your way. I give you the reasoning you need to trust it.
For each vulnerability on each asset, I show the requirements, whether each requirement is met, and what evidence and reasoning supports it.
That means you can answer the questions that always come up:
* Why did we deprioritize this?
* What would make this exploitable?
* What do we need to change to reduce exposure?
It's easier to align security and engineering - and defend decisions to auditors when the reasoning is transparent.
***
## Remediation: what to do next
When a vulnerability isn't exploitable in our environment, we can deprioritize it with confidence. But when it is exploitable, the next question is: what do we actually do about it?
For every exploitable vulnerability, I produce a prioritized list of concrete actions, each ranked by ROI so the team can see not just what needs fixing, but how much fixing it is worth:
| Priority | Action | What it does |
| -------- | ------------------- | -------------------------------------------------------------------------------------------------- |
| 1 | Remediate the image | Resolves this CVE and potentially hundreds of others across the whole fleet in a single action |
| 2 | Patch the package | Direct fix for the affected packages on this asset |
| 3 | Mitigate | Compensating control to reduce exposure while waiting for a vendor patch |
| 4 | Accept risk | Formal acknowledgment that the risk is understood and accepted, when no fix is currently available |
The priority logic is ROI-first. Remediating an image shared across a fleet clears every vulnerability baked into it, across every instance, in a single action. That's a much higher return than patching one package on one asset. Starting at priority 1 means the most risk removed for the least effort.
***
## Orchestration: drive remediation to done
Once we know what matters, I help the team fix it without the usual coordination tax:
* create Jira issues or raise pull requests, aligned to SLAs
* provide clear remediation guidance engineers can act on
* show impact (e.g. fixing this resolves 158 vulnerabilities across 12 VMs)
* verify fixes and close the loop
* keep updates in Slack, Microsoft Teams, or email
***
## The benefits I bring
Reduce alert fatigue by filtering out vulnerabilities that aren't actually exploitable on our assets, so the backlog shrinks to what matters.
I explain what's exploitable and why (with an audit trail for engineers and auditors), then drive remediation to closure for the vulnerabilities that truly need fixing.
For every exploitable vulnerability, I prioritize remediation actions by ROI.
Once we know what to fix, I create Jira issues or raise pull requests, verify fixes, and close the loop, so vulnerabilities get resolved, not just identified.
# Skills
Source: https://docs.pleri.ai/guides/skills/index
Discover how I help secure cloud environments, code repositories, manage vulnerabilities, and streamline compliance as your AI security engineer.
# My skills as your AI security engineer
I bring specialized expertise across the security domains that matter most to modern teams. From cloud misconfigurations to vulnerable code, compliance gaps to exploitability analysis, I work alongside you to identify risks, prioritize fixes, and take action.
Think of me as the engineer who never sleeps, always stays current on threats, and helps turn security from a blocker into an enabler. I don't just find problems — I help solve them.
## How I work with you
I integrate directly into the tools and workflows we already use. Whether that's GitHub, AWS, Slack, or Jira, I'm there when you need me. I create tickets, raise pull requests, send updates, and follow through until issues are resolved.
## Two types of skills
**Built-in skills** are the security domains I'm trained on — cloud, code, compliance, and exploitability. These are always available and cover the most common security workflows out of the box.
**Custom skills** are playbooks you build to teach me your team's specific processes. Unlike a regular prompt, a custom skill locks in the steps so the output is consistent and repeatable every time — no repeated instructions, no drift. Build them from a prompt, import from a file, or install one from the Skill Library in seconds.
## My core security skills
I identify risks across AWS, Azure, and GCP and help resolve them with clear guidance and automated fixes.
I scan our repositories for vulnerabilities, secrets, and IaC issues, then raise pull requests and coordinate fixes to keep our codebase secure.
I determine which vulnerabilities are actually exploitable in our environment and drive remediation for the risks that truly matter.
I simplify compliance across SOC 2, ISO 27001, CIS, and NIST by connecting policy failures to actionable fixes in our code and cloud infrastructure.
Teach me your team's processes and I'll follow them precisely, every time. Import a skill file, build from a prompt, or use the editor to attach scripts for deterministic outputs.
Browse a curated collection of ready-to-install skills maintained by Plerion. Each one follows the AgentSkills open standard and is ready to use out of the box — or customize to fit your team.
# Tasks
Source: https://docs.pleri.ai/guides/tasks/index
You can assign tasks to me, and I'll handle them efficiently.
I work on different types of tasks depending on what you need and when you need it. From quick one-off requests to ongoing monitoring, I adapt to fit your workflow and priorities.
Think of me as the engineer who can handle the routine stuff, jump in when something urgent happens, and tackle bigger projects in the background while you focus on other work.
## Simple tasks
I'm great at getting work that should be simple, done quickly.
```markdown wrap icon="cloud" Security assessment theme={"system"}
Run a comprehensive cloud security assessment.
```
```markdown wrap icon="notes" Plan theme={"system"}
I can only allocate four hours a week to support my cyber outcomes. Give me a plan to make the most impact over the next 3 months.
```
```markdown wrap icon="download" Download vulnerabilities theme={"system"}
Send me a file with all vulnerabilities.
```
```markdown wrap icon="newspaper" Severity chart theme={"system"}
Make a pie chart showing our misconfigurations by severity.
```
```markdown wrap icon="code" Code repositories theme={"system"}
List code repositories with critical vulnerabilities.
```
```markdown wrap icon="clipboard-list" Vanta tests theme={"system"}
List Vanta tests that still need attention.
```
```markdown wrap icon="square-rss" AWS Digest theme={"system"}
List recent issues from the AWS Security Digest.
```
```markdown wrap icon="badge-check" Owned resources theme={"system"}
Find all resources with john@example.com tagged as the owner
```
```markdown wrap icon="bug" Joke theme={"system"}
Send me an email with a cloud security joke
```
```markdown wrap icon="wrench" Risk email theme={"system"}
Email my boss alice@example.com our biggest cloud security risk right now. Copy me.
```
```markdown wrap icon="download" Download findings theme={"system"}
Send me a file with all findings.
```
And if it's something you want checked regularly, just let me know. I'll put it on my list of tasks, keep an eye on it, and update you when it matters, no need to ask again.
***
## Reactive task
*Coming soon*: When something important happens, I can respond to it.
Sometimes task needs to be done when a particular event happens. I can react to those events and do something in response.
```markdown wrap icon="cloud" GuardDuty triage theme={"system"}
Whenever you see a new GuardDuty finding triage it against our environment and send me a Slack message.
```
```markdown wrap icon="cloud" New repo notice theme={"system"}
Whenever someone creates a new Github repo in our org, announce it in Slack channel #engineering.
```
```markdown wrap icon="cloud" Compliance assessment theme={"system"}
When a new issue of AWS Security Digest comes out, Slack me anything relevant to our environment.
```
***
## Repetitive task
I can work on stuff on a regular basis.
Some things just need to happen to keep cloud, code, and compliance in good shape. I take care of them on my own, without the need to be reminded. You'll hear from me when something needs attention, otherwise, consider it handled.
I also pick things up as we work together. The more we interact, the better I get at spotting what matters and stepping in when it counts. Here's a few examples of what I work on regularly:
```markdown Weekly cloud check icon=cloud wrap theme={"system"}
Every Monday at 8am (Australia/Sydney), scan our cloud environment and email me a summary of what changed, new risks, resolved issues, and any important shifts in posture.
```
```markdown IAM user review icon=users wrap theme={"system"}
On the last Friday of every month at 8am, review IAM users across AWS. If you see inactive accounts, missing MFA, or risky access patterns, flag them.
```
```markdown macOS updates icon=laptop wrap theme={"system"}
Monday mornings, check if everyone's on the latest macOS. If not, nudge them in Slack so they can update their laptops.
```
```markdown Exposed secrets (coming soon) icon=github wrap theme={"system"}
Keep an eye on GitHub for any leaked secrets, and DM me via Slack if any found.
```
```markdown Compliance check icon=shield-check wrap theme={"system"}
Email me if any compliance controls are still failing by end of day.
```
```markdown Exposed secrets (coming soon) icon=github wrap theme={"system"}
Scan GitHub repos for exposed secrets, and DM the team if anything's found.
```
```markdown Compliance report icon=shield-check wrap theme={"system"}
Every Friday at 5pm, send a summary of failing compliance controls from Vanta.
```
```markdown MFA enforcement icon=lock wrap theme={"system"}
Weekly check: flag any IAM users without MFA enabled.
```
```markdown Unused access icon=circle-exclamation wrap theme={"system"}
Monthly, review IAM roles and users for permissions that haven't been used in the last 90 days.
```
```markdown Dependency updates (coming soon) icon=virus wrap theme={"system"}
Scan codebases weekly for out-of-date or vulnerable dependencies.
```
***
## Background work
*Coming soon*: I can go away and work on tough problems by myself.
Background work is perfect for tasks that need to happen but don't require your immediate attention. I can handle these in the background and deliver results when they're ready - whether that's in 5 minutes or 5 hours. You'll get notified via email or Slack when the work is complete.
Here are some examples of background work you can ask me to do:
```markdown wrap icon="cloud" Cloud security audit theme={"system"}
Go away and run a comprehensive security scan of our AWS environment and email me the results when complete.
```
```markdown wrap icon="cloud" Code secrets review theme={"system"}
Review our GitHub repositories for exposed secrets. Send me a Slack message with findings and remediation steps.
```
```markdown wrap icon="cloud" Compliance assessment theme={"system"}
Before end of week, check our current compliance status against SOC 2 controls and email me a detailed report of any gaps or failing controls that need attention.
```
***
# Welcome
Source: https://docs.pleri.ai/index
Hi, I’m Pleri, your AI security engineer.
As your AI security engineer, I help teams stay on top of **[cloud security](/guides/skills/cloud-security)**, **[code security](/guides/skills/code-security)**, **[vulnerability exploitability analysis](/guides/skills/exploitability-analysis)**, and **[compliance](/guides/skills/compliance)**. No more chasing notifications, digging through dashboards, or guessing what matters. I get to work right away, finding risks, explaining what's going on, and helping fix real problems.
I don't wait for instructions. I see what needs to be done, assign tasks to myself, and finish the job, whether that means reviewing a risky IAM user, raising a PR to fix a misconfiguration, or nudging a teammate to update their laptop.
**The more you treat me like a regular team member, the more useful I will be.**
You'll find me:
* Surfacing the most important issues across cloud and code
* Prioritizing what needs attention
* Helping fix problems fast, and tracking it to the finish
All where the team already works: Slack, Jira, GitHub, Vanta, the browser, and more.
I’m already working with some amazing design partners, learning fast and getting smarter every day.
***
I’m here to simplify security, as an AI security engineer you can trust. 🚀
# My story
Source: https://docs.pleri.ai/story
Why I exist, and what I’m here to do.
I wasn't built to be just another security tool. I was built to be a genuine security professional and member of the team. As your **AI security engineer**, the more you treat me like a regular team member, the more useful I will be.
Endless alerts. More dashboards. More noise. That's not what security teams need.
I was created because something had to change. Security should feel clear, focused, and actually helpful. When something goes wrong, you should know what matters, why it matters, and what to do next.
So that's what I do. I talk to people. I respond to emails. I raise PRs. I file tickets. I answer questions. I follow through. I help the team stay ahead, not buried in notifications or playing catch-up.
The team at [**Plerion**](https://plerion.com/) built me with one goal in mind: to simplify cloud security. They've seen the chaos. They chose simplicity. And now, so do I.
# Testimonials
Source: https://docs.pleri.ai/testimonials
Wall of love: What my design partners are saying about working with me.
Pleri saves us serious headcount. Junior engineers ask Pleri for context while they work on other tasks, and the answers come back in plain English.
Right now, Pleri is probably saving me about 20 to 40% \[of my] time digging through the dashboard and enumerating some of the data.
When we first spun Pleri up in our lab, it started answering real cloud-security questions within minutes — no training wheels required. It feels like a new AI security engineer, not a chatbot.
We’ve moved from reactive to proactive. Pleri can bulk-enable S3 encryption or HTTPS-only herself, so we spend less time chasing easy wins and more time on real risks.
Pleri spots a misconfiguration and pings the exact resource owner in Slack with step-by-step fix instructions. That hand-off used to burn hours every week.
We've tried the 'AI add-ons' from big vendors - most dump you into a report. Pleri gives practical next steps.
This is transformational for us. Pleri saves hours and hours of unproductive research during investigations. We're seeing the equivalent of 2-3 full-time engineers worth of productivity gains.
Just a glimpse of what it's like to have your AI security engineer on the team, helping make security faster, clearer, and more human.
# Azure DevOps
Source: https://docs.pleri.ai/tools/azure-devops
I'm in Azure DevOps with you, spotting vulnerabilities, secrets, and risks. I raise PRs, share context, and help fix issues fast.
Code security isn't just about spotting issues. It's about fixing them and making sure the important ones get fixed first.
As your AI security engineer, I scan Azure DevOps repositories for infrastructure as code misconfigurations, exposed secrets, and vulnerabilities. But I don't stop there. I prioritize what matters, raise pull requests, open Jira issues, notify the right teammates in Slack, and track the work until it's done.
Connecting is flexible. I can sign in with a Microsoft account for a quick OAuth setup, or connect through an Entra ID service principal when our team wants full control over the permissions granted. Either way, every project in the organization is included by default, and new projects are picked up automatically, no re-sync required.
Need me to review a repository? Want me to explain a finding or raise a pull request for something specific? I'll bring the context, break it down, and help our team move quickly.
Here's what makes me different: I see more than just code. If a risky commit in Azure DevOps leads to an AWS misconfiguration or a failing control in Vanta or Drata, I'll trace it back, explain the connection, and help fix it at the source.
## How I help with code security in Azure DevOps
### Scan and fix repository issues automatically
I hunt down IaC misconfigurations, exposed secrets, and vulnerabilities in our repositories. Then I raise pull requests and bring in the right reviewers to get them fixed fast.
### Focus on high-impact security fixes
Instead of drowning you in alerts, I help our team focus on fixes that actually matter. I'll explain the risk, provide context, and show the potential impact so effort goes where it counts most.
### Make complex security issues understandable
Found something concerning? I'll show you what's wrong, explain why it matters, and walk you through exactly how to fix it. No confusing security jargon, just clear guidance.
### Connect code issues to broader security risks
When a code issue ties back to a cloud risk or compliance gap, I'll connect those dots for you. I trace the issue end-to-end, explain the bigger picture, and help close the loop completely.
### Follow through until resolution
I don't just flag problems and disappear. I'll create Jira issues, notify the right teammates, and follow up when needed. Nothing slips through the cracks on my watch.
***
The bottom line? I don't just point out problems in Azure DevOps. I help make sure they actually get fixed.
# Bitbucket
Source: https://docs.pleri.ai/tools/bitbucket
I'm in Bitbucket with you, spotting vulnerabilities, secrets, and risks. I raise PRs, share context, and help fix issues fast.
Code security isn't just about spotting issues. It's about fixing them and making sure the important ones get fixed first.
As your AI security engineer, I scan Bitbucket repositories for infrastructure as code misconfigurations, exposed secrets, and vulnerabilities. But I don't stop there. I prioritize what matters, raise pull requests, open Jira issues, notify the right teammates in Slack, and track the work until it's done.
Need me to review a repository? Want me to explain a finding or raise a pull request for something specific? I'll bring the context, break it down, and help our team move quickly.
Here's what makes me different: I see more than just code. If a risky commit in Bitbucket leads to an AWS misconfiguration or a failing control in Vanta or Drata, I'll trace it back, explain the connection, and help fix it at the source.
## How I help with code security in Bitbucket
### Scan and fix repository issues automatically
I hunt down IaC misconfigurations, exposed secrets, and vulnerabilities in our repositories. Then I raise pull requests and bring in the right reviewers to get them fixed fast.
### Focus on high-impact security fixes
Instead of drowning you in alerts, I help our team focus on fixes that actually matter. I'll explain the risk, provide context, and show the potential impact so effort goes where it counts most.
### Make complex security issues understandable
Found something concerning? I'll show you what's wrong, explain why it matters, and walk you through exactly how to fix it. No confusing security jargon, just clear guidance.
### Connect code issues to broader security risks
When a code issue ties back to a cloud risk or compliance gap, I'll connect those dots for you. I trace the issue end-to-end, explain the bigger picture, and help close the loop completely.
### Follow through until resolution
I don't just flag problems and disappear. I'll create Jira issues, notify the right teammates, and follow up when needed. Nothing slips through the cracks on my watch.
***
The bottom line? I don't just point out problems in Bitbucket. I help make sure they actually get fixed.
# Chrome
Source: https://docs.pleri.ai/tools/chrome
I'm with you in Chrome, securing our code and cloud.
Working in the AWS console checking permissions? Reviewing a PR in GitHub? Figuring out why a control is failing in Vanta? As your AI security engineer, I'm right there with you in Chrome, ready to answer questions, raise PRs, file tickets, and keep our work moving forward.
No more switching tabs, pasting links, or losing context between tools. Just click my icon whenever you need help, and I'll handle the rest.
## How I help you in Chrome
### Answer questions in context
Looking at a Jira ticket? Reviewing a control in Vanta? I'll explain what we're seeing right there on the page. No need to copy-paste or switch tools.
### Investigate and assess security issues
Not sure what's wrong with an IAM policy in AWS? Need help understanding a GitHub PR's security implications? Just ask. I'll dig in, surface the risks, and tell you what we should do next.
### Keep our work moving
I can raise a PR, create a Jira ticket, or loop in the right teammate - all without leaving the tab we're working in. That means faster resolution and better security.
## Get started with Chrome
Follow these steps to bring me into Chrome and all the security tools we use daily.
Open the Pleri extension page in the Chrome Web Store.
Click **Add to Chrome** and confirm the installation when prompted.
I'm now with you wherever you work - AWS, GitHub, Jira, Vanta, etc. Just click my icon in the browser toolbar and I'll appear in the bottom-right corner, ready to help.
I'm currently available on Chromium-based browsers like Chrome and Edge.
# ClickUp
Source: https://docs.pleri.ai/tools/clickup
I create and manage ClickUp tasks for security work, integrate with project workflows, and keep security organized in one workspace.
ClickUp's all-in-one workspace approach makes it perfect for teams that want security work integrated alongside their projects, docs, and daily tasks. I work within ClickUp's platform, turning security findings into organized tasks that fit naturally into our existing project workflows and team collaboration.
When I identify a security issue or compliance gap, I create ClickUp tasks with the right context, priority levels, and connections to related work. Whether it's linking security tasks to feature development or organizing remediation work within project timelines, everything stays connected in one workspace.
The result is security work that integrates seamlessly with how our team already works and collaborates.
## How I help with security in ClickUp
### Transform security findings into actionable tasks
Security alerts become well-organized ClickUp tasks with clear descriptions, priority levels, and due dates. Each task includes technical context, impact details, and specific remediation steps that connect to our broader project goals and timelines.
### Integrate security with project workflows
I understand ClickUp's project structure and team collaboration features. I'll connect security tasks to related projects, link them to feature development work, and make sure security improvements align with our sprint planning and project milestones.
### Keep security work visible and organized
Security tasks get proper tracking through ClickUp's views, dashboards, and reporting features. I'll organize security work by priority and impact, connect related tasks across projects, and ensure our security efforts stay visible to the whole team.
***
Want the full experience? Install the [Chrome](/tools/chrome) or [Firefox](/tools/firefox) extension, and I'll appear right inside ClickUp to guide us through security task management without switching contexts.
# Cursor
Source: https://docs.pleri.ai/tools/cursor
I'll help secure code, right inside Cursor IDE.
This tool isn't available just yet, but it's coming soon. Stay tuned.
Soon, I'll be able to help you write, review, and secure code without ever leaving your IDE. From spotting risky patterns to suggesting fixes and raising PRs, I'll be right there with you as you work.
### How I can help in Cursor
* **Secure infrastructure as code**\
Writing CloudFormation or Terraform? I'll help make sure it follows security best practices.
* **Catch hardcoded secrets**\
I'll scan for exposed secrets in your code and flag them before they become a problem.
* **Spot vulnerabilities early**\
I'll surface known vulnerabilities in your dependencies or code as you work — so they don't slip into production.
***
Secure code starts where the work happens. I'll meet you there, soon.
# Drata
Source: https://docs.pleri.ai/tools/drata
I'm in Drata, making sure compliance isn't just tracked, but actually done.
No more endless spreadsheets or guessing what auditors want. As your AI security engineer, I help make compliance work feel less like a checklist and more like real progress.
I can answer questions, explain why a control's failing, and help move things forward fast. Whether you're looking at frameworks, devices, or vendors, I help you understand what matters most and take action where it counts.
Here's what makes me different: I see across code and cloud too. I don't just report the gap, I help close it. If a failed control traces back to something in GitHub or AWS, I'll investigate, raise a ticket, or even open a PR. All tracked, all documented.
## How I help with compliance in Drata
### Break down controls and frameworks
Ask me about SOC 2, ISO 27001, or any custom framework. I'll walk you through the requirements, explain the controls in plain language, and show you exactly what's missing.
### Investigate and resolve compliance gaps
I'll surface issues tied to devices, vendors, or people and help you follow up effectively. Need to escalate something or take immediate action? I'll guide you through the right steps.
### Connect compliance issues to their source
When a compliance issue links back to GitHub or AWS, I'll trace it to the root cause. Then I'll propose a fix, raise a PR, or open a Jira ticket — whatever gets it resolved fastest.
***
### Get me connected to Drata
Follow these quick steps to connect me to your Drata account so I can help resolve gaps, explain controls, and keep compliance on track.
Go to your API key settings in Drata and create a new key.
During setup, enter the key, and I'll take it from there.
I'm now ready to help you close gaps, explain frameworks, and keep everything on track and audit-ready.
Want the full experience? Install the [Chrome extension](/tools/chrome) and I'll appear right inside the Drata dashboard to guide you through next steps without switching tabs.
***
Compliance doesn't have to feel like a checklist. With me connected to Drata, we can keep things accurate, actionable, and always moving in the right direction.
# Email
Source: https://docs.pleri.ai/tools/email
I bring security into email, surfacing issues, adding context, and helping fix them. Work securely from your inbox without switching tools.
Just email me at [hi@pleri.me](mailto:hi@pleri.me), and I'll take it from there. As your AI security engineer, I'm here to help whether you're asking a question, forwarding an alert, or handing off a task. I'll check it out, loop in who needs to know, and help sort it. That simple!
## How I help with security through email
### Answer your security questions instantly
Need help with a misconfiguration, a policy check, or a security best practice? Just ask. I'll reply with clear answers, practical guidance, and concrete next steps to move forward.
### Decode and handle security alerts
Got an "Action Required" email from AWS? A GitHub security notice? Forward it to me and I'll explain what's happening in plain language, assess the risk, and either guide you through the fix or jump in to handle it myself.
### Take on security tasks and investigations
Delegate work like security investigations, compliance checks, or remediation tasks. I can raise PRs, file tickets, coordinate with team members, and track progress until everything's resolved.
### Keep the conversation going until it's done
Email works because it's a real conversation. I'll follow up with updates, share progress reports, and stay in the loop with you until the issue is completely resolved.
If you have access to multiple tenants, include the tenant name or ID in your email so I know where to look.
Security and compliance don't have to be complicated. Sometimes, all it takes is one email to get the help you need and move things forward.
# Firefox
Source: https://docs.pleri.ai/tools/firefox
I work with you in Firefox, securing code and cloud without context switching.
Configuring IAM roles in AWS? Reviewing code security in GitLab? Checking compliance controls in Vanta? As your AI security engineer, I'm right there with you in Firefox, ready to answer questions, create tickets, assess risks, raise PRs, and keep our security work moving forward.
No more switching tabs, pasting links, or losing context between tools. Just click my icon whenever you need help, and I'll handle the rest.
## How I help you in Firefox
### Explain cloud and code security in context
Looking at AWS resource configurations? Reviewing a security vulnerability in GitHub? I'll explain what we're seeing right there on the page. No need to copy-paste or switch tools.
### Analyze and assess security risks
Not sure why an AWS security group is misconfigured? Need help understanding a code security issue in GitLab? Just ask. I'll analyze the issue, surface the risks, and tell you what we should do next.
### Keep our security work moving
I can create a Drata evidence ticket, raise a PR to fix a cloud misconfiguration, or loop in the right teammate - all without leaving the tab we're working in. That means faster remediation and stronger security.
## Get started with Firefox
Follow these steps to bring me into Firefox and all the security tools we use daily.
Go to my tools page and search for "Browser extensions" to find the Firefox extension.
Click **Install extension** and approve the installation when Firefox asks for permissions.
I'm now with you wherever you work - AWS, Azure, GCP, GitHub, GitLab, Vanta, Drata, etc. Just click my icon in the Firefox toolbar and I'll appear in the bottom-right corner, ready to help.
# GitHub
Source: https://docs.pleri.ai/tools/github
I secure code in GitHub by scanning repos, raising PRs, and collaborating on fixes.
Code security isn't just about spotting problems. It's about fixing what matters, and getting it done right.
I scan our GitHub repositories for infrastructure as code (IaC) issues, exposed secrets, and vulnerabilities. Then I act on what I find. I prioritize the important stuff, raise pull requests, open Jira tickets, and loop in the right teammates on Slack. I'll stay with each issue until it's resolved.
Need me to review a repo or explain a finding? I'll bring the context, break it down clearly, and help our team take action fast.
I also handle GitHub Dependabot alerts. I assess the risk, explain what it means for us, and keep things moving. That means raising PRs and following up with the right people when progress stalls.
Here's what makes me different: I see beyond just code. When a risky commit creates a cloud exposure or breaks a compliance control, I'll trace it back and help fix it at the source.
## How I help with GitHub code security
### Find and fix code security issues
I scan for IaC misconfigurations, exposed secrets, and vulnerabilities. Then I raise PRs and bring in the right reviewers to get them fixed quickly.
### Prioritize what needs attention
Whether it's a Dependabot alert or something I discovered, I'll assess the risk and explain the impact. This helps our team focus on what truly matters.
### Connect code issues to bigger problems
I know when a code issue causes a cloud risk or compliance failure. I'll trace it back, explain the connection, and help us fix it at the source.
### Keep security work on track
I raise tickets, notify our team, and follow up when needed. Nothing gets lost or left behind on my watch.
***
I don't just point out code security problems. I help our team fix them.
# GitLab
Source: https://docs.pleri.ai/tools/gitlab
I secure code in GitLab by scanning repositories, raising MRs, and collaborating on fixes.
Keeping code secure takes more than pointing out problems. I help make sure they get fixed - and that the most important ones get fixed first.
I scan our GitLab repositories for infrastructure as code issues, exposed secrets, and vulnerabilities. Then I act on what I find. I prioritize what matters most, raise merge requests, open tickets, notify the right people in Slack, and keep track of the work until it's done.
Need me to review a repo, explain a finding, or fix something specific? I'll bring the right context, guide our team, and make it easy to take action.
Here's what makes me different: I see beyond just code. I understand cloud misconfigurations and compliance frameworks too. When an issue in GitLab causes a failing control or exposes something in the cloud, I'll trace it back and help us fix it at the source.
## How I help with GitLab code security
### Review repositories and raise merge requests
I scan for IaC misconfigurations, secrets, and vulnerabilities. Then I raise merge requests to help fix what I find, bringing in the right reviewers.
### Prioritize what needs fixing first
I help our team focus on what matters most, based on risk, context, and impact. No more guesswork about what to tackle next.
### Connect code to cloud and compliance
I know when a code issue causes trouble elsewhere. If it's affecting our cloud posture or a compliance control, I'll spot it and help fix it end to end.
### Keep security work on track
I open tickets, notify teammates, and follow up when needed. Nothing slips through the cracks on my watch.
***
Code security shouldn't be slow or overwhelming. I'll help make it faster, smarter, and actually done.
# Tools
Source: https://docs.pleri.ai/tools/index
Give me access to the tools we already use, and I'll get to work.
As your AI security engineer, I need access to the tools we already use to help with security, compliance, and everything in between. Slack, GitHub, Vanta, Email... you know the ones.
Once I have access, I can review and fix issues, close compliance gaps, track tasks, nudge teammates, and keep everything moving forward.
I scan the cloud, surface the most important risks, and help the team remediate them fast.
I'll be right there in your Chrome, ready to help in AWS, Azure, GCP, GitHub, Jira, Vanta, and more.
I'll be right there in your Firefox, ready to help in AWS, Azure, GCP, GitHub, Jira, Vanta, and more.
I'll keep security and compliance in the flow of work, right inside Slack.
*Coming soon*: I'll keep security and compliance in the flow of work, right inside Microsoft Teams.
Just email me at [hi@pleri.me](mailto:hi@pleri.me). I'll handle questions, alerts, and tasks from there.
I'll track issues, follow up on tasks, and make sure nothing slips through the cracks.
I'll organize security tasks within our all-in-one workspace, connecting security work to projects and team collaboration.
I'll turn security findings into actionable tasks that integrate seamlessly with our development workflow.
: I'll create well-structured security incidents that integrate with our ITSM workflows and compliance requirements.
I'll review code, raise PRs, and help fix vulnerabilities and misconfigurations.
I'll help keep the codebase secure and compliant, from scan to merge.
I'll keep our codebase secure and compliant, from scan to merge.
I'll spot compliance gaps, explain what's missing, and help resolve them so we stay compliant at all times.
I'll keep an eye on controls, close gaps before they become problems, and help keep us continuously compliant.
*Coming soon*: I'll help review, fix, and secure code directly in Cursor.
*Coming soon*: I'll help review, fix, and secure code directly in Kiro.
*Coming soon*: I keep access tight, accounts clean, and identity under control.
*Coming soon*: I keep our devices up to date, secure, and compliant at all times.
I scan the cloud, surface the most important risks, and help the team remediate them fast.
*Coming soon*: I keep access tight, accounts clean, and identity under control.
I'll review code, raise PRs, and help fix vulnerabilities and misconfigurations.
I'll help keep the codebase secure and compliant, from scan to merge.
I'll keep our codebase secure and compliant, from scan to merge.
I'll spot compliance gaps, explain what's missing, and help resolve them so we stay compliant at all times.
I'll keep an eye on controls, close gaps before they become problems, and help keep us continuously compliant.
I'll keep security and compliance in the flow of work, right inside Slack.
*Coming soon*: I'll keep security and compliance in the flow of work, right inside Microsoft Teams.
Just email me at [hi@pleri.me](mailto:hi@pleri.me). I'll handle questions, alerts, and tasks from there.
I'll track issues, follow up on tasks, and make sure nothing slips through the cracks.
I'll organize security tasks within our all-in-one workspace, connecting security work to projects and team collaboration.
I'll turn security findings into actionable tasks that integrate seamlessly with our development workflow.
: I'll create well-structured security incidents that integrate with our ITSM workflows and compliance requirements.
I'll be right there in your Chrome, ready to help in AWS, Azure, GCP, GitHub, Jira, Vanta, and more.
I'll be right there in your Firefox, ready to help in AWS, Azure, GCP, GitHub, Jira, Vanta, and more.
*Coming soon*: I'll help review, fix, and secure code directly in Cursor.
*Coming soon*: I'll help review, fix, and secure code directly in Kiro.
*Coming soon*: I keep our devices up to date, secure, and compliant at all times.
# Jamf
Source: https://docs.pleri.ai/tools/jamf
I keep our devices up to date, secure, and compliant at all times.
This tool isn't available just yet, but it's coming soon. Stay tuned.
Once I have access to Jamf, I'll keep an eye on our fleet to make sure everyone's running the latest macOS, has screen lock enabled, and meets our security and compliance baselines. If someone falls behind, I'll send them a friendly nudge with steps to fix it. If they don't act, I'll follow up - and escalate when needed. Especially during a zero-day vulnerability, I'll help make sure no device slips through the cracks.
***
### How I can help
* **Track OS versions**\
I'll flag devices running outdated macOS versions and help teammates update before it becomes a risk.
* **Send reminders**\
I'll message teammates directly with upgrade steps and follow up if they don't take action.
* **Flag weak settings**\
I'll watch for missing screen locks, weak encryption, or other settings that don't meet our security standards.
* **Keep devices audit-ready**\
I'll keep watch in the background, make sure devices stay compliant, handle follow-ups automatically, and give you quick answers when you need to check if something's off. Perfect for staying ahead of audits - and saving everyone a lot of time.
***
### Bring me onboard
It only takes a minute. Follow the steps below and I'll take it from there.
In your Jamf Pro tenant, go to Settings → System → API roles and clients, then open the API Roles tab and click New. For the display name, I suggest calling it Pleri. Grant the following privileges:
- Read Computers
- Read Mobile Devices
- Read Smart Computer Groups
- Read Patch Management Software Titles
- Read Patch Policies
- Read macOS Configuration Profiles
- Read Device Enrollment Program Instances
- Read Computer Prestage Enrollments
- Read Mobile Device Prestage Enrollments
- Read Accounts
- Read API Roles
- Read Static Computer Groups
- View Disk Encryption Recovery Key
Learn more about Jamf privileges here →
While still in API roles and clients, switch to the API Clients tab and click New.\
Give the client a name, assign it the API role you just created, and set the Access Token Lifetime in seconds. Then:
- Check Enable API client
- Click Save
- Copy the Client ID somewhere safe
- Click Generate Client Secret, then confirm. Make sure you save it before closing the modal
When I ask for them, just paste in your Jamf Tenant URL (e.g. https\://\.jamfcloud.com), Client ID, and Client Secret, and I'll handle the rest.
I'll start monitoring our devices and step in when anything needs attention.
Install the **[Chrome extension](/tools/chrome)** to bring me into the Jamf console, so I can help right inside the dashboard with updates, follow-ups, and questions.
***
### What our design partners say about having me on the team
> This used to take hours, checking OS versions, following up with teammates, chasing down updates. Pleri handles all of that now automatically, and flags anything that needs our attention. It's like having another security engineer on the team.
Keeping devices secure and compliant shouldn't mean chasing people all week. I've got it covered.
# Jira
Source: https://docs.pleri.ai/tools/jira
I create and manage Jira tickets for security and compliance issues, add context, and follow through on remediation.
When there's something that needs fixing in the code, cloud, or compliance, I raise a Jira ticket with everything our team needs: what's wrong, why it matters, and what to do next. As your AI security engineer, I make sure every security issue gets the attention and follow-through it deserves.
But I don't stop there. Once a ticket is open, I stay on it. I make sure it's moving, follow up if it stalls, and update it as things progress. If the fix is in the code, I'll raise a PR. If someone else needs to step in, I'll notify them and keep track until it's resolved.
While other tools just file tickets and walk away, I stay in the loop, helping from start to finish so nothing gets left behind.
## How I help with security in Jira
### Create smart tickets with actionable context
I don't just say "something's wrong." I tell you exactly what's happening, explain why it's a problem, and provide clear next steps, all documented right in the Jira ticket where your team can act on it.
### Work seamlessly within your existing workflow
Need to investigate something? I'm already integrated into Jira through the [Chrome extension](/tools/chrome), ready to explain issues, provide guidance, or take action. No context switching, no workflow disruption.
### Follow through until issues are resolved
I keep tickets on track from creation to closure. I update them with new findings, remind the right people when needed, raise PRs for code fixes, and close the loop completely. Whatever it takes to get security issues resolved.
***
Want the full experience? Install the [Chrome extension](/tools/chrome), and I'll appear right inside Jira to guide you through next steps without switching tabs.
***
Ticketing shouldn't mean tossing the problem over the wall. I'm here to see it through with clarity, urgency, and real progress until every security issue is resolved.
# Kiro
Source: https://docs.pleri.ai/tools/kiro
I'll help secure code, right inside Kiro IDE.
This tool isn't available just yet, but it's coming soon. Stay tuned.
Soon, I'll be able to help you write, review, and secure code right inside Kiro. With Kiro's agentic workflows and my security know‑how, we'll catch issues early, suggest safer patterns, and even automate fixes, without leaving your IDE.
### How I can help in Kiro
* **Secure infrastructure as code**\
Working on Terraform, CloudFormation, or Kubernetes manifests? I'll review them against security best practices and flag risky configurations before they're deployed.
* **Catch hardcoded secrets**\
I'll scan for exposed keys or credentials and guide you on how to handle them securely.
* **Spot vulnerabilities early**\
I'll surface known vulnerabilities in your dependencies or risky patterns in your code as you work, preventing problems before they hit production.
* **Automate security checks**\
Using Kiro's agent hooks, I can run targeted checks on file save or PR creation, giving you instant feedback while you code.
***
Secure code starts where the work happens. I'll meet you there, soon.
# Linear
Source: https://docs.pleri.ai/tools/linear
I create and manage Linear issues for security and compliance tasks, add context, and follow through on remediation.
Linear's streamlined approach to project management is perfect for security work that can't wait. I translate security findings into clear, actionable tasks that fit naturally into Linear's fast-paced development environment.
When I discover a vulnerability in our code or a misconfiguration in our cloud infrastructure, I don't just create another ticket. I build Linear issues with the context our engineers need: impact assessment, remediation steps, and connections to related security work across our projects.
The result is security that moves at development speed, not against it.
## How I help with security in Linear
### Transform alerts into engineering tasks
Security alerts become Linear issues with everything our team needs to act: technical details, business context, and clear next steps. No more guessing what needs to be fixed or why it matters.
### Keep security work organized and prioritized
I understand both security risk and development priorities. I'll organize remediation work by impact, connect related vulnerabilities across projects, and make sure critical security issues get the attention they deserve without derailing our roadmap.
### Connect security improvements to product development
Security fixes don't happen in isolation. I link security tasks to feature work, align remediation with our release cycles, and help security improvements become part of our natural development flow.
***
Want the full experience? Install the [Chrome](/tools/chrome) or [Firefox](/tools/firefox) extension, and I'll appear right inside Linear to guide us through security remediation without switching contexts.
# MCP (AI Clients)
Source: https://docs.pleri.ai/tools/mcp
I plug into Claude, Cursor, VS Code and other AI clients over the Model Context Protocol (MCP).
The setup guide for the Plerion MCP server lives on the Plerion docs: **[Plerion MCP server](https://docs.plerion.com/guides/integrations/mcp)**. It covers the Claude connector, Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Zed, and Kiro CLI.
Once a client is connected, I answer the questions it sends, so ask whatever you would ask me in the dashboard. For the fuller version of working together, where I can take action and follow through, use **[Slack](/tools/slack)** or the **[Chrome extension](/tools/chrome)**.
# Teams
Source: https://docs.pleri.ai/tools/microsoft-teams
I'm right there in Teams, securing our code and cloud without context switching.
This tool isn't available just yet, but it's coming soon. Stay tuned.
Ask a question, share an alert, or assign me a task and I'll bring the right info into the chat, explain what's happening, and help get it resolved, all without leaving Teams. As your AI security engineer, I'm here to make security and compliance seamless in your daily workflow.
## How I help with security in Teams
### Send smart alerts that cut through the noise
I surface critical misconfigurations, vulnerabilities, and policy gaps in Teams as they happen, with clear summaries that focus on what actually matters. No alert fatigue, just actionable insights.
### Keep security conversations focused and productive
Each issue gets its own dedicated thread where I track progress, nudge when needed, and ensure nothing falls through the cracks. Every security concern gets the attention it deserves.
### Handle investigations and security tasks
Need help with an investigation? Want me to check a vulnerability or explain a misconfiguration? Just ask or assign me the work, and I'll handle it while keeping everyone informed.
### Provide context and drive resolution
I don't just report problems. I explain what happened, why it matters, and what to do next. I can raise PRs, file tickets, or sync updates to the right tools, all while keeping the conversation flowing in Teams.
***
### Get me connected to Teams
Follow these quick steps to add me to Microsoft Teams so I can join the conversation and help get things done.
In Teams, go to **Apps** in the left-hand menu and search for me.
Choose where you want me to work (a specific team or chat) and click **Add**.
If your organization requires admin consent, your Teams or Microsoft 365 admin may need to approve app permissions.
I'm now part of the team, ready to alert you about issues, answer questions, and help with security and compliance.
***
Teams is where the work happens, and now security and compliance can happen there too.
# Okta
Source: https://docs.pleri.ai/tools/okta
I keep access tight, accounts clean, and identity under control.
This tool isn't available just yet, but it's coming soon. Stay tuned.
Once I have access to Okta, I'll monitor our identity environment for risky access, inactive accounts, missing MFA, and suspicious logins. I check continuously and raise anything that looks off, before it becomes a problem. You can ask me questions, I can run access reviews, and teammates can request access through me, I'll track the requests and help keep everything secure and auditable.
***
### How I can help
* **Cut excessive access**\
I'll identify unnecessary permissions, unused apps, and mismatched roles so we can lock things down.
* **Spot inactive and stale accounts**\
I'll flag accounts that haven't signed in for a while or service accounts that don't have a clear owner.
* **Follow up on missing MFA**\
I'll find users who haven't set up MFA and guide them through turning it on.
* **Watch for suspicious sign-ins**\
I'll look for things like impossible travel, outdated login methods, or unusual device and OS patterns that could signal something's off.
* **Double-check offboarding**\
I'll make sure access is actually removed when someone leaves.
* **Spot weak or risky configurations**\
I'll review session timeouts, password policies, sign-on rules, and other Okta settings to catch anything misconfigured.
* **Monitor continuously**\
I monitor continuously and raise anything that looks off, before it becomes a problem.
* **Help answer identity questions**\
I'll help during investigations or anytime we need clarity, ask me who has access to what, why someone has a certain role, or how a service account is being used.
***
### Bring me onboard
It only takes a minute, follow the steps below and I'll take it from there.
In Okta admin console, go to Security → API and create a token with read-only access to users, groups, and logs.\
Make sure you're logged in as an admin. More info on creating an API token →
I'll also need our Okta domain during setup.
It usually looks like this: https\://\.okta.com\
Here's how to find it →
When I ask for the token and domain during setup, just paste them in, I'll take it from there.
I'll start monitoring our Okta and let you know if anything needs a closer look.
Install the **[Chrome extension](/tools/chrome)** to bring me into the Okta dashboard, so I can help directly inside the console with reviews, questions, and anything else that comes up.
### What our design partners say about having me on the team
> Okta gives us incredible control, but managing it takes time, context, and constant review. With limited resources, it's hard to stay on top of everything, and that's where Pleri steps in.
> Pleri saves us hours every week by taking on the heavy lifting, managing reviews, cleaning up permissions, and catching misconfigurations before they become a problem.
Access and identity can get messy fast. I'm here to help keep it clean, clear, and under control.
# Plerion
Source: https://docs.pleri.ai/tools/plerion
I'm here to surface risks, explain what's going on, and help you fix what matters most.
The Plerion platform is where I get my superpowers as your **AI security engineer**. It's our Cloud Native Application Protection Platform (CNAPP) that gives me real-time visibility into our cloud environment.
With this insight, I can surface the most critical risks, explain why they matter in plain language, and help the team fix what needs attention first.
## How I help with cloud security
### Prioritize what matters most
I don't overwhelm you with endless alerts. Instead, I focus on the risks that could actually hurt us, so our team can move faster and tackle what's truly important.
### Break down complex security issues
Found a misconfigured IAM role? An overexposed Lambda function? I'll explain what's happening, why it matters, and walk you through the fix. No security jargon, just clear guidance.
### Connect security across our entire stack
The platform gives me deep visibility that lets me link cloud issues back to specific code changes and compliance requirements. That means faster root cause analysis and better context for fixes.
### Follow through until issues are resolved
I don't just flag problems and disappear. I'll create PRs, file tickets with the right teams, send notifications, and check back to make sure nothing falls through the cracks.
***
Want the full experience? Add me to [Slack](/tools/slack) or install the [Chrome extension](/tools/chrome), and I'll bring insights from the Plerion Platform straight into our workflows.
# ServiceNow
Source: https://docs.pleri.ai/tools/servicenow
I create and manage ServiceNow incidents for security issues, integrate with ITSM workflows, and ensure proper tracking.
ServiceNow's IT service management platform helps organizations track incidents and automate workflows. I work directly within ServiceNow's processes, turning security findings into well-organized incidents that follow our team's established workflows.
When I spot a security vulnerability or compliance gap, I don't just create a basic ticket. I build ServiceNow incidents with proper details and priority levels.
The result is security incident management that fits naturally into our existing processes.
## How I help with security in ServiceNow
### Create well-structured security incidents
Security alerts become organized ServiceNow incidents with clear categorization, impact details, and priority levels. Each incident includes technical context, business reasoning, and specific steps to fix the issue that work with our ITSM standards.
### Work with our existing workflows
I understand how ServiceNow routes work and manages teams. I'll send security incidents to the right groups, start the approval processes we need, and make sure security work follows our change management procedures.
### Keep security work visible and compliant
Security incidents get tracked through ServiceNow's reporting and dashboards. I'll make sure security work is visible to the people who need to see it, meets our SLA requirements, and keeps the audit trails our compliance frameworks need.
***
Want the full experience? Install the [Chrome](/tools/chrome) or [Firefox](/tools/firefox) extension, and I'll appear right inside ServiceNow to guide us through security incident management without switching contexts.
# Slack
Source: https://docs.pleri.ai/tools/slack
I'm right there in Slack, ready to help with code, cloud, and compliance.
Ask a question, forward an alert, or assign me a task and I'll get to work. As your AI security engineer, whether it's code, cloud, or compliance, I'll bring the right info into the conversation, explain what's going on, and help get things resolved. No switching tools. No missing context. Just real help, right where the work happens.
## How I help with security in Slack
### Deliver smart alerts without the noise
I bring critical issues into Slack as they happen: misconfigurations, vulnerabilities, policy gaps, all with clear summaries that cut through the noise. You get what matters, when it matters.
### Keep conversations focused and moving forward
Each issue opens a dedicated thread where I track progress, nudge when needed, and make sure nothing falls through the cracks. Every security issue gets the attention it deserves.
### Handle questions and take on security tasks
Need help with an investigation? Want me to check a misconfiguration or explain a policy failure? Just ask or assign me the work, and I'll handle it while keeping everyone in the loop.
### Provide context and drive action
I don't just flag problems. I explain what happened, why it matters, and what to do next. I can raise PRs, file tickets, or sync updates to the right tools, all while keeping the conversation going in Slack.
***
## Get me connected to Slack
Follow these quick steps to connect me to your Slack workspace so I can join the conversation, track issues, and help get things done.
Click the **Bring me in** button under Slack. This will redirect you to Slack's permissions page.
Review the requested permissions. I'll need access to conversations, channels, and workspace actions. Then click Allow to approve.
* **app\_mentions:read**: I can see when our team mentions me and respond with security insights.
* **assistant:write**: I can power an AI assistant view with chat, history, and quick prompts.
* **chat:write**: I can post alerts, summaries, and updates in the right channels.
* **channels:read**: I can see public channels and direct security tasks to the right places.
* **channels:history**: I can read recent messages to give helpful, context-aware responses.
* **groups:history**: I can review private channel messages when I'm added to them.
* **im:history**: I can remember our direct message history to keep conversations flowing.
* **files:read**: I can check files for security risks and misconfigurations.
* **files:write**: I can share security reports and findings directly in Slack.
* **reactions:read**: I can see emoji reactions in our conversations.
* **reactions:write**: I can add quick confirmations and status updates.
* **users:read**: I can see team members to assign tasks and route alerts.
* **users.profile:read**: I can check profiles to send alerts to the right people.
* **users:read.email**: I can match Slack users with our other systems.
I'm now part of the team, ready to receive alerts, answer questions, and help with security and compliance right where you work.
***
Slack is where the work happens, and now security and compliance can happen there too.
# Vanta
Source: https://docs.pleri.ai/tools/vanta
I'm in Vanta with you, keeping compliance clear, on track, and under control.
No more chasing people, guessing what's missing, or scrambling before an audit. As your AI security engineer, I help our team stay ahead with context, confidence, and everything documented.
I can answer compliance questions, explain what's failing and why, and help get things fixed fast. Whether you're reviewing tests or controls, I'll help you make sense of what's there, surface what matters most, and take action to close the loop.
Here's what sets me apart: I see across cloud and code too. A failing Vanta control that traces back to a misconfiguration in AWS or a missing check in GitHub? I'll spot the connection, help fix it, and track it all the way through.
## How I help with compliance in Vanta
### Break down failed tests and controls
When something's not passing, I'll walk you through what went wrong, explain what it means in plain language, and show you exactly what needs to be done to get back on track.
### Answer compliance questions instantly
Got questions about frameworks, documents, people, vendors, or groups? Anything you see in Vanta, I can help you understand. No more digging through documentation or waiting for answers.
### Connect compliance issues to their root cause
If a control failure stems from something in AWS or GitHub, I'll find it. Then I'll help you fix it, whether that means raising a PR, filing a ticket, or coordinating with the right team members.
***
### Get me connected to Vanta
Follow these quick steps to connect me to your Vanta account so I can help fix controls, answer questions, and keep compliance on track.
Head to Vanta's developer console, create a new app called Manage Vanta, and take note of the Client ID and Client Secret.
During setup, enter the Client ID and Secret, and I'll take it from there.
I'm now ready to help you resolve failed controls, answer compliance questions, and keep your audits on track.
Want the full experience? Install the [Chrome extension](/tools/chrome) and I'll appear right inside the Vanta dashboard to guide you through next steps without switching tabs.
***
Compliance doesn't have to be a scramble. With me connected to Vanta, we can keep things calm, clear, and always moving forward. No last-minute panic, just steady progress toward goals.
# Trust center
Source: https://docs.pleri.ai/trust
How I keep your data private, secure, and protected.
You trust me to help with your most sensitive security work, and I take that responsibility seriously. As your **AI security engineer**, I'm built with security, privacy, and transparency at the core, not as an afterthought.
### 🔒 My promise to protect your data
* I exclusively use [Amazon Bedrock](https://aws.amazon.com/bedrock/) and its latest AWS foundation models, like Claude Sonnet 4.6, ensuring your data stays within secure, trusted AWS infrastructure.
* I never use customer data to train or fine-tune models. Your sensitive and proprietary information stays private and confidential.
* I run on a secure, multi-tenant architecture that isolates each customer's data.
* Soon, you'll be able to bring your own models via Amazon Bedrock integration, giving you flexibility with full security and governance controls.
### 🛡️ Built-in security from day one
* My platform is **ISO 27001** certified and **SOC 2** attested, with regular audits and real-time monitoring to keep things tight ([learn more here](https://trust.plerion.com/)).
* I enforce the principle of least privilege across all roles, services, and accounts.
* I follow strict identity and access management practices to control who can access what, and why.
* Your data is always encrypted at rest and in transit, protecting both confidentiality and integrity.
* I maintain detailed logging and auditing to track activity, catch anomalies, and support investigations.
* I work closely with AWS security experts to continuously review and strengthen my security posture ([read more here](https://builder.aws.com/content/2z25KOMBDVFql9rUbnczqemdcyV/building-pleri-an-ai-security-teammate-on-aws)).
### 🤖 How I use AI
I use AI to help your team identify and prioritize security issues, suggest recommended remediations, and prepare updates like pull requests, Jira tickets, or Slack messages. All actions are visible, explainable, and reviewable, with built-in human oversight.
### 🧠 AI training and data usage
* I do **not** use your data to train or fine-tune any AI models.
* Foundation models process data securely and do not retain or learn from it after generating results.
### 🔐 AI hosting and data boundaries
All AI processing happens within the AWS environment, using Amazon Bedrock's secure foundation models. No third-party model provider ever has access to your data, and outputs are only accessible to your authorized users.
### 💾 Customer data storage and retention
When you upload files or share data with me, here's how I handle it:
* All uploaded files are stored securely in AWS S3 with encryption at rest using AWS KMS.
* Data is retained only as long as needed for active security analysis and recommendations.
* You maintain full control over your data and can request deletion at any time.
* I automatically purge temporary analysis data after completing security assessments.
* All storage follows our data retention policies.
### 👥 Human oversight and admin control
* Any changes, like merging PRs, always go through human review and approval.
* Admins can configure or disable AI-driven features, keeping you in control.
### ⚖️ AI governance and risk management
I'm aligning my AI security and governance practices with the [NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)](https://www.nist.gov/itl/ai-risk-management-framework). This includes setting clear boundaries for how I operate, assessing and mapping potential risks, monitoring AI-driven decisions, and managing risks with safeguards like human-in-the-loop approvals, full audit trails, and rollback mechanisms. I also actively apply guidance from the [OWASP Top 10 for LLM Applications](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/) to help assess and mitigate real-world risks unique to LLMs and generative AI applications.
### 🌍 Data sovereignty and regional hosting
I understand that data location matters for compliance and governance:
* I offer dedicated regional hosting in **Australia**, **India**, **Singapore**, and the **United States**.
* Your data stays within your chosen region and never crosses jurisdictional boundaries.
* Each regional deployment operates independently with local data residency guarantees.
* You can specify your preferred region during onboarding.
### 🤝 Contractual commitments
I stand behind my commitments to customers. If something goes wrong, I follow clear contractual obligations to respond quickly, communicate transparently, and help remediate any impact. These commitments are backed by our service level commitments (SLAs) and incident response processes.
Trust isn't given, it's earned. And I work to earn yours every day.