Before You Begin: What Frontier AI Defense Needs

Frontier AI Defense works on data you already have. This page lists what needs to be in place, what you get back, and a checklist you can work through with your DataBee contact before you start.

What goes in, what comes out

Your scanner findings, threat intelligence, your application list, and your CMDB go in. Ranked applications, routed tickets, proof of fixes, and coverage gaps come out.

What goes in:

• Scanner findings — the vulnerabilities your scanner already finds on your servers.
• Threat intelligence — which vulnerabilities attackers are actually using, from the public NIST CVE and FIRST EPSS feeds. You connect these like any other feed.
• Your line-of-business applications — each application, its business owner, and the servers it runs on. This is the most important input: it is how findings on servers become risk to the business.
• Your CMDB — every server and the IT team that owns it.

What comes out:

• Applications ranked by exposure, and the few fixes that clear most of their findings. See Finding Your Riskiest Applications.
• Tickets sent to the right team, in your ServiceNow or by email. See Sending Fixes to Remediation Teams.
• Proof it got fixed — a later scan, not a closed ticket, confirms each fix. See Tracking Remediation Activity.
• Gaps you didn't know about — servers with no owner, servers that have never been scanned, and servers past their vendor's end-of-life.

What you need

Four things are required. Without them, Frontier AI Defense still opens, but it cannot rank your applications.

Your line-of-business application list

Your scanner knows servers. Only you know which servers make up, say, your claims portal. This list is how Frontier AI Defense connects the two.

Example: the Claims Portal has a business owner and three servers. The scanner reports findings on the same three hostnames, so those findings attach to the application.

For each application, provide:

1. Application name, flagged as line of business. Retired or inactive applications are left out.
2. Business owner — the name and email of the person who funds and answers for the application.
3. Supporting servers — every server and host the application runs on.
4. Optional: Business criticality (Critical, High, Medium, Low). It appears as a filter and does not change the score.

The one rule: name servers the way your scanner names them, by hostname or IP address. If the names don't match, the findings can't reach the application.

Example file layout. Any column names work.

You bring the list in as a feed, and it is stored in your data lake like any other. The usual sources are:

• Already in ServiceNow — business applications in your CMDB, related to the servers that support them, through the ServiceNow CMDB feed.
• A file — a spreadsheet or CSV export from wherever you keep it, laid out like the example above, through a custom feed.

You can combine sources; Frontier AI Defense looks at the application data in your lake, not at which feed brought it in. A file needs a custom feed, so allow about a week for that and send your DataBee contact a sample early.

Access and network

• Who gets access. Your people sign in to DataBee through your organization's own login. An administrator then gives each person a role: Administrator or Security Analyst to manage Frontier AI Defense, or Data Engineer to view it. See Roles and permissions.
• Network access. DataBee connects out to your scanner's API and, if you use it, your ServiceNow instance. If either sits behind a firewall or IP allow-list, ask your DataBee contact for DataBee's outbound IP addresses and allow them.
• Email. If you send work by email, make sure messages from DataBee are not filtered as spam. Your DataBee contact can give you the sending address.

Checklist

Work through this list with your DataBee contact. Credentials and the application list take the longest, so start those first.

• ☐ Data lake chosen (Snowflake, AWS S3, or Azure ADLS), in the same region as your DataBee tenant, and connected
• ☐ Scanner API credentials created (Qualys VMDR or Tenable VM)
• ☐ NIST CVE and FIRST EPSS feeds connected
• ☐ Application servers scanned at least weekly
• ☐ Line-of-business application list connected as a feed, with owners and servers (send your DataBee contact a sample first if it needs a custom feed)
• ☐ Server names in the list match the scanner's hostnames or IP addresses
• ☐ ServiceNow CMDB credentials created (OAuth client and ITIL-role user) — recommended
• ☐ ServiceNow connection added on the Integrations page — optional
• ☐ DataBee's outbound IP addresses allowed by your scanner and ServiceNow, if they restrict access
• ☐ Users signed in and given the Administrator, Security Analyst, or Data Engineer role

How to tell it's working

Until the required data arrives, Frontier AI Defense shows a setup checklist instead of your applications. Each item turns green when its data is in, and the page switches to your applications as soon as the scanner, application, and threat-intelligence items are all ready. If you have permission to add feeds, each missing item has a button that takes you there; otherwise the checklist tells you to ask a DataBee administrator. To see what the finished page looks like before your data lands, select See it with sample data.

Until the required data arrives, the page shows what is still missing and where to connect it.

If your applications are found but none link to servers your scanner reports, the checklist says Not linked to servers. That almost always means the server names in your application list don't match your scanner's hostnames or IP addresses. Once the page is running, an orange banner warns you if fewer than half of your scanned servers belong to an application, because findings on those servers don't count toward any score.

After that:

• The dates at the top of the Frontier AI Defense page show recent scans and threat-intelligence updates.
• The number of applications matches your list.
• Most of your scanner's findings appear under an application. Agree on a target with your DataBee contact at the start; findings that don't appear usually mean a server name doesn't match.
• The top application shows a business owner and a remediation team.

Next steps

• Frontier AI Defense Overview
• Finding Your Riskiest Applications
• Sending Fixes to Remediation Teams