Almost every security vendor now says it uses AI. The claims range from modest ("AI helps us summarise reports") to sweeping ("our AI detects and stops every threat"). For the organisations buying these services, it is often unclear what the AI actually does, what a person still checks, and who is responsible when the conclusion is wrong.
FLODISQ works with specialised AI agents in every service. This article explains how we divide the work, and why we think that division matters more than the technology itself.
The problem AI helps with
Security work has a volume problem. A mid-sized organisation may have hundreds of suppliers, thousands of assets, tens of thousands of vulnerability findings and a constant stream of threat reporting. Policies, contracts, audit reports and questionnaires add up to thousands of pages. A team of specialists cannot read and connect all of it, so in practice they sample: a few suppliers, a selection of systems, the last quarter's reports.
Sampling is a reasonable compromise, but it means that relationships between findings are missed. A vulnerability that looks minor on its own may be serious because of the supplier that has access to the system. A policy may look complete until it is compared with the actual configuration.
What AI does well
In our experience, AI agents add most value in four types of work:
- Processing volume. Reading and extracting information from large sets of documents, findings or threat reports, so that nothing has to be skipped because there was no time.
- Structuring. Mapping findings to frameworks such as ISO 27001 or MITRE ATT&CK, grouping duplicates, and putting unstructured information into a consistent format.
- Connecting. Linking threats, systems, suppliers and controls that are normally analysed separately, and showing where they meet.
- Consistency. Applying the same checks to every supplier, every document or every finding, so that the result does not depend on who did the work or how tired they were.
In each FLODISQ service, an agent is set up for this kind of work: collecting and organising threat information, analysing supplier questionnaires and evidence, mapping the attack surface and linking test findings, comparing requirements with policies and controls, and tailoring training material to the organisation's own risks and test results.
What remains human
Context
An agent can tell you that a supplier's certificate does not cover a particular location. It cannot know that this location is about to close, that the contract is being renegotiated or that the board has already decided to move to another provider. Context about the organisation, its plans, culture and constraints changes what a finding means.
Source evaluation
AI tools are good at summarising what sources say. They are less reliable at judging whether a source should be believed, whether a claim has been copied from elsewhere, or whether an apparently confirmed fact rests on a single report. In threat intelligence and supplier assessment, this judgement is central. Our analysts check the sources behind every conclusion that matters.
Deciding what is relevant
Agents tend to produce a lot of output. Part of the specialist's work is to remove what is not relevant, false or already known, so that the client receives a short list of findings that actually require attention. Without that step, AI simply moves the volume problem from one place to another.
Decisions and advice
Choosing priorities, recommending a course of action and explaining the trade-offs to a board are professional judgements. They depend on the client's risk appetite, resources and situation. They must also be defensible: if a client asks why we recommended something, a person has to be able to explain the reasoning and stand behind it.
Accountability
Every FLODISQ deliverable is reviewed and signed off by a specialist. The AI is a tool that helps us do the work more thoroughly and quickly. It is not a party to the engagement and it is not responsible for the outcome. We are.
An example from a supplier assessment
Consider a supplier assessment for an organisation with around two hundred suppliers. The AI agent reads all completed questionnaires, certificates, SOC reports and contract clauses that are available. It compares the certificate scope with the services each supplier delivers, flags answers that contradict the attached evidence, notes missing incident notification terms and groups suppliers by the type of data and access they have.
That work would take a team several weeks. The agent produces a first structured overview in a short time. The specialist then reviews it. Some flags turn out to be irrelevant, for example a scope gap for a service the organisation no longer uses. Others are more serious than the agent could see, because the specialist knows that one supplier is the only provider of a critical service and would be very difficult to replace. The specialist then discusses the most important findings with the client, decides which suppliers need a deeper assessment, and writes the advice.
The client receives a complete picture instead of a sample, and the conclusions are made by someone who understands their situation and can explain them.
Where it goes wrong
The risks of AI in security work are not hypothetical. Common problems include:
- confident statements without traceable sources;
- findings that look plausible but are not supported by the evidence;
- generic recommendations presented as tailored advice;
- sensitive client information processed in tools without adequate controls.
We address these by keeping sources and evidence attached to every finding, by having specialists validate results before they reach the client, and by controlling which data is processed where. Clients can ask at any time which parts of the work were supported by AI and how.
Questions to ask any provider
If you are evaluating a security service that uses AI, these questions help to see what is really behind the claim:
- Which specific tasks does the AI perform, and which are done by people?
- Who checks the output before it reaches us, and what do they check for?
- Can you show the sources or evidence behind a conclusion?
- Where is our data processed, and is it used to train models?
- Who is accountable if a conclusion turns out to be wrong?
A provider that cannot answer these clearly is probably not in control of its own tooling.
Conclusion
AI makes it possible to look at all suppliers instead of a sample, all findings instead of the top ten, all reporting instead of last week's. That is a real improvement. But the value of security advice lies in context, judgement and accountability, and those remain with people. We use AI to give our specialists more to work with and more time to think, not to replace the thinking.
Each service page describes how this works in practice, for example in Threat Intelligence, Supply Chain Security and Security Testing. More about the specialists behind the work can be found on the About page.