AI agents

Radius360 ships twelve continuously-running agents. Each watches a specific signal across your stack and writes proposals into your AI Proposals Inbox. Nothing acts on its own. Every proposal is a recommendation that you approve or reject. The decision is logged with your identity, the timestamp, and the evidence the agent used to make the recommendation.

The agentic loop

The platform runs a continuous loop in the background:

1. Ingest — connectors pull live data from your EDR, SIEM, cloud, identity, and code stack.
2. Map — findings are normalized and tied to risks, controls, and the active audit period.
3. Run — the twelve agents read the new state and emit proposals into the inbox.
4. Decide — you review, approve, or reject. Decisions are logged.
5. Act — approved proposals create mitigation tasks, attach evidence, escalate vendors, or feed the audit narrator.

The agents

Each agent has a single, well-scoped job:

Drift Watcher

Detects posture changes between syncs. If MFA coverage on M365 drops from 92% to 87%, Drift Watcher writes a proposal naming the three accounts that opted out and the control they affect.

Evidence Reviewer

Auto-approves recurring passing evidence and isolates the failing or anomalous rows for human review. Cuts most of the manual evidence-vault triage.

KEV Watcher

Watches the CISA Known Exploited Vulnerabilities catalog and matches new entries against your asset inventory. Writes a proposal when one of your assets is exposed to a KEV-listed CVE.

Gap Scanner

Finds controls in your active audit period that have no current-period evidence. Prioritizes by impact and proposes which integration is most likely to satisfy each gap.

Risk Drafter

For any new risk, drafts a 30/60/90-day remediation plan with proposed owners, scope, and supporting controls. You edit and approve before the plan turns into mitigation tasks.

Audit Narrator

Drafts audit-ready narratives from approved evidence in the active period. Produces per-control narrative paragraphs that auditors can read alongside the evidence binder.

SLA Escalator

Watches mitigation tasks against their SLA. Writes a proposal when a critical-risk task is at risk of breaching, naming the owner and the days remaining.

Dormant Privilege

Surfaces unused admin access. If five Global Admins haven’t authenticated in 90+ days, Dormant Privilege proposes them as candidates for de-privilege.

Integration Health

Watches connector freshness and authentication failures. Writes a proposal when a sync goes silent, an OAuth token needs refresh, or a deep integration starts throttling.

Audit Readiness

Tracks how close you are to an audit window. Writes periodic readiness assessments: “SOC 2 Type II window starts in 14 days · 87% of controls have current period evidence.”

Vendor Risk

Watches third-party SOC 2 expiration and posture drift. Flags inherited controls that will lose coverage when a vendor’s report ages out.

Playbook Matcher

Suggests proven playbooks for new findings. If a new RDS-backup risk matches a PITR-enable playbook by 4 of 5 actions, Playbook Matcher proposes it.

Identity Hygiene Proposer

Pattern-matches the four most common identity hygiene risks emitted by M365 and Workspace deep syncs (Conditional Access missing, OAuth grants with high-risk scopes, 2-Step Verification disabled, missing DMARC) and drafts specific, actionable remediation steps for each. Proposals carry the actual click-by-click remediation in proposed_action.args.steps so approving creates an owned mitigation task with the playbook already attached. Closes the loop from "found" to "here's exactly what to do, want to ratify?".

Closing the loop on approval

When an AI proposal that links to a risk gets approved, three things happen atomically:

1. If the risk already has an auto-trigger task ("Mitigate: …"), the executor hydrates that task in place with the proposal's specific remediation steps. No duplicate task is created.
2. The linked risk transitions Open → In Progress with a note referencing the proposal.
3. The dashboard's "What needs your attention" widget filters In Progress out, so the approved risk drops off the home screen automatically. The mitigation task inherits the assignment + Jira push.

This is the "decide once, route everywhere" pattern: the operator's approval updates the proposal queue, the risk register, the task queue, the dashboard, and (when wired) the external ticket — from one click.

How proposals reach you

Proposals appear in three places:

• The AI Proposals Inbox on your dashboard (overview tab).
• Your weekly digest email, summarizing what was proposed and what remains pending.
• Per-surface contextual surfaces — the Risk Detail page surfaces Risk Drafter proposals, the Evidence Vault surfaces Evidence Reviewer recommendations, and so on.

Approving and rejecting

Each proposal has Approve and Reject buttons. Approvals execute the action (create a task, attach evidence, escalate the vendor). Rejections close the proposal and tell the system to suppress similar future proposals for a window.

Both decisions are logged in the audit trail with your user, the timestamp, and the full proposal payload. This is what makes “agentic” safe in a regulated environment: there is no autonomous action.

Suppression and noise

To prevent inbox flooding, each producer respects a 60-day suppression window per unique proposal summary. If you reject a proposal, the same summary won’t re-emit for 60 days unless the underlying signal materially changes.

Recently-emitted proposals (within the last 24 hours) are also deduplicated, so a flapping signal doesn’t pile multiple cards into the inbox.