What is Frontier AI Defense?
Most organizations have far more open vulnerabilities than they could ever fix at once. Frontier AI Defense answers the question every security and IT team eventually asks: “What should we fix first, who has to do it, and did it actually get fixed?”
Frontier AI Defense takes the vulnerability findings your scanners already send to DataBee and organizes them around the business applications your organization depends on. For each application it shows:
- How exposed it is — a single 0–100 Exposure score, so the riskiest applications rise to the top.
- What fixes it — the specific patches or configuration changes that would close the most problems, often far fewer than the number of findings suggests.
- Who owns it — the business owner and the IT teams responsible for the underlying servers.
- What really happened — whether the work sent to those teams actually removed the problem, judged by later scans rather than by a ticket being closed.
What goes in, what comes out
Frontier AI Defense combines four inputs: your vulnerability scanner's findings, threat intelligence (the public NIST CVE and FIRST EPSS feeds, which you connect like any other feed), your list of line-of-business applications (with the servers each one runs on), and, ideally, your CMDB. In return you get applications ranked by exposure, tickets routed to the teams that own the servers, scan-based proof that each fix worked, and a clear view of servers nobody owns or scans. For the full list of requirements and a setup checklist, see Before You Begin: What Frontier AI Defense Needs.
Where to find it
Select Exposure in the top navigation bar. The Exposure Management page opens on the Overview tab.
The Frontier AI Defense page opens on the Overview tab, with summary cards for the whole estate.
The page has three tabs:
- Overview — the big picture: summary cards, charts, and this week's remediation work.
- Applications — every application ranked from most to least exposed. See Finding Your Riskiest Applications.
- Activity — a running log of what was sent to teams and what scans found afterward. See Tracking Remediation Activity.
Anything you filter or open is saved in the page address, so you can copy the link from your browser and share exactly what you are looking at.
Key concepts
- Application — a business system (for example, a billing or claims platform) made up of the servers and devices that run it.
- Finding — one vulnerability that a scanner detected on one device.
- CVE — the public ID given to a known vulnerability, such as CVE-2025-51303.
- Fix — one patch or change from a vendor. A single fix often clears many findings at once, across many devices.
- Exploitation — how much evidence there is that attackers are using a vulnerability. Frontier AI Defense uses three grades: Actively exploited, Exploit PoC (a working proof-of-concept attack exists), and No known exploit.
- CISA KEV — the U.S. government's Known Exploited Vulnerabilities list. Anything on it is treated as actively exploited.
- EPSS — a public estimate of how likely a vulnerability is to be exploited soon. Frontier AI Defense uses it only to break ties between applications with very similar scores.
- Remediation owner — the IT team (usually the ServiceNow assignment group) responsible for patching a device.
- Dispatch — a package of work Frontier AI Defense sends to a remediation owner, as a ServiceNow incident or an email.
The summary cards
The row of cards at the top of the Overview summarizes your whole environment. Select any card to jump straight to the applications behind the number.
| Card | What it tells you |
|---|---|
| Applications | How many business applications are being tracked. |
| Actively exploited | How many applications have at least one vulnerability attackers are using right now, and how many of those are on the CISA KEV list. |
| Distinct fixes | How many separate patches would clear the open findings, and how many findings they would clear. This number is usually much smaller than the number of findings, which is the point: it shows how much work there really is. |
| Devices behind | How many devices have gone 90 days or more without a patch, plus how many have never been scanned or are past their vendor's end-of-life. |
| Nobody to dispatch to | How many applications have work waiting but no owner on file to send it to. These need an owner assigned before anything can be fixed. |
The charts
- Applications by Exploitation — a donut chart showing how many applications fall into each exploitation grade.
- Highest Exposure Applications — the applications with the highest Exposure scores. Select a bar to open that application's details.
The Week's Work
The Week's Work is a grid of every piece of remediation work the environment is asking for. Each row is a team (or, using the toggle above the grid, an application). Each column is one fix. The number in a cell is how many findings that fix would clear for that row.
The Week's Work grid: rows are remediation teams, columns are fixes grouped by how urgently they are being exploited.
A few things make this grid easy to read:
- Most urgent work is on the left. Columns are grouped under Actively exploited, Exploit PoC, and No known exploit. A fix that is being actively exploited always sorts ahead of a routine patch, no matter how many devices the routine patch touches.
- Color shows urgency, not size. Darker cells are more urgent; a large number in a grey cell is routine work.
- Underlined numbers mean some of the devices involved are behind on patching.
- Unassigned rows (flagged in orange) are work that has no owner yet.
Select a cell to see a short brief beneath the grid: the fix, how urgent it is, how many findings and devices it clears, the health of those devices, and a Compile button to send the work to the team. See Sending Fixes to Remediation Teams.
Selecting a cell shows what that fix clears and offers a Compile button to send it.
Roles and permissions
| Permission | Allows | Included in these roles |
|---|---|---|
| View application posture | See Frontier AI Defense in the navigation and use the Overview, Applications, and Activity tabs. | Data Engineer, plus every role below |
| Manage application posture | Everything above, plus the Scoring settings and Remediation routing controls. See Configuring Scoring and Routing. | Administrator, Security Analyst |
The Controls, Controls Admin, and Approver roles do not include access to Frontier AI Defense.
Frontier AI Defense must also be entitled for your tenant. If you do not see it in the navigation, contact your DataBee administrator.