Once you know what needs fixing, Frontier AI Defense packages the work and sends it to the teams that have to do it — as ServiceNow incidents or by email. Each package lists exactly which fix to apply, which servers need it, and which findings it will clear.
Start sending work
You can start from several places — whichever is closest to what you are looking at:
- The Compile button on a row in the Applications list.
- The Compile button in a cell brief on The Week's Work.
- Compile remediation work at the bottom of an application's details panel, or Compile this fix on its Fixes tab.
- The Compile button for a team on the Ownership tab.
- The Compile button in a vulnerability event. See Responding to a New Vulnerability.
If the button is greyed out, there is nobody on file to send the work to. Assign an owner first.
Choose how to send it
The Compile remediation work window opens with sensible defaults set by your administrator. You can adjust them for this dispatch only:
The Compile remediation work window. Choose how to group the work, how to send it, and which teams receive it.
- Group as — how to bundle the work:
- One per fix (default) — a separate item for each fix. Easiest for teams to work and track.
- One per application — everything for this application in one item.
- One per owner — everything a team owes, across all their applications.
- Send as — ServiceNow (creates an incident) or Email. Each dispatch uses one channel.
- ServiceNow connection — when sending to ServiceNow, choose which ServiceNow connection receives the work. Connections are set up once by an administrator on the Integrations page. If there is only one, it is selected for you.
- Copy the business owner on every item — keeps the application's business owner informed.
- Dispatch to — when several teams are involved, tick the ones you want to send to now.
- Review the preview of each item. It shows the priority, short description, assignment group, and one section per fix with What needs to be done, the Affected configuration items (servers), and the Findings cleared. Untick any fix you want to leave out.
- Select Send.
Priority is set automatically: 1 – Critical for anything on the CISA KEV list, 2 – High for other Critical-severity work, and 3 – Moderate for everything else.
Fixes that were already sent appear greyed out and are not sent twice.
Tracking what you sent
Every dispatch is recorded on the application's Dispatches tab. This is where Frontier AI Defense is most different from a ticketing system: it judges progress by what later scans find, not by whether the ticket was closed. Closing a ticket never closes a finding — only a scan showing the problem is gone does.
The Dispatches tab shows each ticket, its ServiceNow state, and how many of its findings scans have confirmed as fixed.
Each dispatch shows who it went to, when, its current ServiceNow state, and a progress line such as “12 of 14 findings fixed by scan evidence.” Watch for these labels:
- Fully remediated (green) — scans confirm every finding in the dispatch is fixed.
- Closed, still detected (amber) — the ticket was closed but scans still find the problem. Follow up with the team.
- No movement in 7d (amber) — the ticket has not changed state in a week or more.
Frontier AI Defense also adds the scan evidence back onto the ServiceNow incident as a comment, so the team working the ticket can see the same picture.