# SecOps Autopilot

> Drives Tenable CVE findings through KRI risk scoring, approval-gated remediation, containment, and verified evidence.

- Type: Skill
- Author: sword0x00
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-11-04
- Source repository: https://github.com/sword0x00/SecOps-Autopilot
- Repo state: not archived
- Last push: 2026-11-04T18:45:21Z
- Stars: 1 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Cisco, Anthropic
- Domains: governance-risk-compliance, security-operations
- Tags: vulnerability-management, tenable, kri, remediation, claude-code, secops
- Date added: 2026-11-04
- Compatible platforms: Claude Code
- Invocation: `/secops-autopilot`
- Listing page: https://exchange.tenable.com/skills/secops-autopilot
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/secops-autopilot.md

SecOps Autopilot is an AI agent that carries an identified vulnerability from
detection to a verified, evidenced fix. It automates the KRI process across
Tenable, asset inventory, security controls, patch management, the NAC solution,
and ticketing, and writes an audit-ready evidence package.

## What it does

- Normalizes a CVE or advisory and resolves the affected endpoints and servers
  from Tenable.
- Runs the KRI-01 … KRI-09 register per asset and ranks by real risk rather than
  raw CVSS.
- Produces a remediation plan with patch targets and compensating controls.
- Creates a ticketing-system ticket only after a recorded Human Approval, then
  gates containment, patch submission, and restore behind separate Human Approval
  conditions.
- Verifies the fix with a fresh Tenable read and writes an audit-ready evidence
  package: Markdown/HTML reports and a SHA-256 manifest.
- Produces one consolidated management report across all CVEs and assets in
  Markdown, HTML, and PDF.

## How it works

Install the Python engine with `pip install -e .` and the Claude Code skill from
`SKILL.md`. The `secops` CLI runs the read-only pipeline with
`secops run --cve <CVE>` and stops at the first state change. Each gate is opened
explicitly with `secops approve --gate <ticket|remediation|containment|patch|restore>`.
Ticketing, NAC, EDR, and patch connectors are simulated by default and pluggable
for live systems; Tenable Vulnerability Management is live-tested, while the
Tenable Security Center and Cisco ISE ERS adapters follow documented APIs and are
marked not live-validated.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/secops-autopilot.json. The full index and how to read it: https://exchange.tenable.com/llms.txt