Procedure AI
The verticalisations
The same agent, the same queues, the same approvals. What changes is the catalogue of procedures — and the way you begin.
Four routes, four ways to start
These are not maturity levels: they are ways to buy. One is switched on with a subscription and no project, one is pointed at your estate and runs, two begin with a project that starts from half a day of analysis.
Application Management
Accounts to create, passwords to reset, permissions to change, data to fix on business applications. We have done it with people for years: we are moving the repetitive part onto procedures.
Open →Switched on across your estateEndpoint compliance
Check encryption, antivirus, patches and backups on every computer, fix what is not right and produce the evidence NIS2 and auditors ask for. The catalogue exists: we point it at your estate and it runs.
Open →Tailored verticalisationYour departments' processes
HR, finance, purchasing, production. We have been automating company processes for thirty years: what changes now is who runs them.
Open →Off the shelf, with public pricingAI ServiceDesk
IT support: a first-line technician on every person's computer. It is the verticalisation we took to market first, and it has a site of its own.
Open →Application Management
After go-live, a business application generates years of small, almost identical requests: accounts, passwords, permissions, data to fix. It is a service we already deliver, with live contracts and people doing it every day: the procedures exist and are written into the contracts, and we are moving them onto automatic procedures starting with the two most frequent ones.
Reset a password
The most frequent and the least risky, on one condition: being sure who is asking. Identity is verified with a code from the authenticator app, not with “I recognise your voice”. Nobody has to authorise it, and it closes in thirty seconds at any hour.
Create an account
From the name and the role comes an account with the permissions of that profile, not the ones copied from the last person hired — which is how permissions multiply without anyone deciding. The manager authorises, and until they answer no account exists.
Change permissions
A change of role, a temporary assignment, an access to remove. The procedure also does the thing that by hand never gets done: it writes down what was there before, so you can go back and you know who had what.
Fix data
This one takes more care: a wrong correction on a business application is not undone with a button. The procedure first shows what would change, on how many rows, and waits. The data owner always authorises.
A business application password, at two in the morning
The night shift has no IT department to call. This is where automation is worth most.
- Who asks
- I can't get into the system any more, it says wrong password
- The knot
- Before resetting anything you have to be sure who is asking. This is the point where phone support trusts the voice, and every now and then somebody gets in as somebody else.
- How it verifies
- asks for the code from the authenticator appcode correct: identity verifiedcode wrong or missing: it resets nothing and opens the request to a person
- What it runs
- The approved procedure, with a service account that can reset passwords and nothing else. The credential is not in the script: it is fetched at the moment, used and discarded.
- What stays written
- Who asked, how their identity was verified, which procedure, on which system, at what time.
Where these procedures run. Not on the user's computer but on the business application, from a service machine, talking to the system the way that system is built for: its interface where there is one, the database where that is the only route. If the application is ours this part is already solved; if it belongs to another vendor, the first piece of the project is working out which door you come in through — sometimes half a day, sometimes the longest part, and you can see which of the two straight away.
Endpoint compliance
Since NIS2 became law, and for anyone with a certification to maintain, the question is no longer “are the computers protected?” but “show me they were, on every machine, on that date”. It is the shape the engine already knows: check first, then fix, then write down what it found.
| What is checked | If it is not right |
|---|---|
| Disk encryption | encryption is switched on and the recovery key is put somewhere safe — the part that by hand never gets filed properly |
| Antivirus on and current | protection is re-enabled and signatures updated; if the service won't restart the case goes to a person, because it is a symptom of something else |
| System updates | stuck updates are unblocked and the machine reboots inside an agreed window, never in the middle of the working day |
| Screen lock | automatic lock is set after the minutes you decided |
| Local administrators | it lists who they are; removal is not automatic, it becomes a request: taking a permission away at the wrong moment stops someone's work |
| Backup present and recent | it checks the backup exists and is from yesterday, not from March; if it is missing that is an urgent request |
| Disk space and health | space is freed with the approved clean-ups; if the disk shows signs of failing no clean-up is run at all and a replacement is opened |
The sweep, and the laptop that was not encrypted
How a compliance problem is found nine months before the audit, instead of three days after it became an incident.
- Who starts it
- No user: it is a campaign across the estate, inside the window you chose. Nobody notices it is happening.
- On how many machines
- It starts on a pilot group. If the success rate drops below the threshold, the campaign suspends itself and waits for a person, instead of propagating the error across the whole estate.
- What it finds
- On one machine the disk is not encrypted. It is a laptop that arrived as an emergency replacement six months earlier, and nobody repeated the preparation. That is the normal way a machine falls out of the rules: not by intent, by haste.
- What it does
- switches encryption on and puts the recovery key somewhere safehad the disk shown signs of failing it would have encrypted nothing: it would have opened a replacement
- What it won't do alone
- On the same machine it finds two local administrators who should not be there. It does not remove them: it opens a request.
- What remains
- The list of every machine with the outcome of every check and the time. Machines that were switched off come out as not verified, not as “fine”: that is different information and worth keeping apart.
How you start. The first sweep runs within days of installing the agents and produces the document with the state of every machine: from there you decide what to fix automatically and what to take to a person, with the numbers in front of you. One thing about timing: today the checks start on request or from a planned campaign — the automatism that repeats them every night on its own is the piece under construction, and a real project brings it forward.
The life of a workstation
These are the four moments when, by hand, a piece always gets forgotten — and the forgotten piece is almost always the one that later becomes a security problem.
Last day
All access closed at the same time, work data handed to whoever takes over, machine returned to a clean, reassignable state, with the list of what was closed.
Known-state machines
Tills, kiosks, line computers: the procedure doesn't wait for a request, it runs every night and puts the machine back to the state you defined. In the morning, the list of what had changed.