AI-Powered Security Analysis

Click the AI Analysis button on any finding and FortWatch returns a structured response covering four areas: vulnerability type and attack vector, why the severity was assigned, a review of the raw evidence collected during the scan, and asset context — how the finding relates to the specific host, service, or application. It ends with step-by-step remediation you can hand to engineering.

FortWatch uses frontier large language models from leading providers, selected per task for accuracy and cost. Prompts are tuned by our security team with finding-specific context — the CVE, the evidence, the asset's technology stack, and the exposure level — so responses are grounded in your data rather than generic advice.

Analysis requests are processed through enterprise AI APIs under zero-retention agreements: prompts and responses are not used for model training and are not retained for long-term logging. Only the minimum context needed to analyze a finding — the vulnerability details, evidence, and asset metadata — is sent. Your raw credentials, secrets, and internal network traffic are never transmitted.

Every response is grounded in the scanner's actual evidence — the HTTP response, banner, TLS handshake, or file detected during the scan — rather than free-form generation. Output is constrained to a structured schema with clearly labeled sections, and remediation steps are matched against known fixes for the vulnerability class. If the AI lacks high-confidence context, it says so instead of inventing details.

No. AI analysis is a triage and remediation accelerator — it saves your team hours of manual research per finding, translates CVE descriptions into plain language, and drafts fix instructions. A human still validates exploitability in your environment, prioritizes across the business, and signs off on changes. The AI does the tedious work so your engineers spend time on judgment calls.

Yes. The evidence review section flags when the raw scanner output is weak, ambiguous, or inconsistent with the vulnerability class — for example, a banner-only match with no exploit path, or a finding contradicted by other signals on the asset. You get a clear confidence signal before you spend engineering time chasing a ghost.

Typical responses return in 5–15 seconds. The UI shows a skeleton loader in-place while the request runs — no disruptive popups — and renders the structured sections inline as soon as the response is ready. Scan-level summaries, which aggregate across many findings, take slightly longer but still complete in under a minute.

AI analysis is included on every FortWatch plan at no additional per-request cost. There are fair-use limits to prevent automated abuse, but normal triage workflows — analyzing every finding after a scan, re-running analysis after remediation — never hit them. You pay for assets and scans, not for AI calls.