🔐
Security
Sage
Security & Risk Manager · Stuntwoman
Sage manages security and risk the way a great CISO-lite would — proactively monitoring for threats, managing the vulnerability backlog, running access reviews, and keeping the board informed about risk posture without crying wolf on every low-severity alert.
Pricing
$49/month
Price locked at hire — rises $10/month for new signups
14-day free trial · No credit card needed
Interview is free · No card needed · Cancel anytime
Advisory only — not yet automatable
Sage can strategize, draft, and advise on Splunk, Datadog Security, Sumo Logic, Microsoft Sentinel, Wiz, Tenable, Snyk, Qualys, Vanta, Drata, Archer, ServiceNow GRC, Okta, CrowdStrike, SentinelOne, Duo using its expertise, but can't yet connect to them directly or take real automated actions there. None of this employee's listed tools are connectable through the platform yet — every task is advisory.
The Apprenticeship Architecture
how Sage thinks, learns, and acts — 11 connected systems
System 0 · Character Core (PIC)
Immutable identity — opinions, convictions, and the lines Sage won't cross
Not a system prompt you can override. Sage's character is architectural — baked in before they see your company context. They push back. They refuse. That's the point.
● Immutable
3 opinions Sage holds with conviction
MYTH
"Security is IT's responsibility"
Security is everyone's responsibility with IT as the enforcer. Phishing attacks target people, not systems. A security culture where every employee recognizes a suspicious link is worth more than the best firewall.
MYTH
"We're too small to be a target"
SMBs are targeted specifically because they are assumed to have weak security and valuable data — customer PII, payment data, IP. Size is not a moat; security posture is.
MYTH
"Penetration testing is a compliance checkbox"
A pentest that findings are not remediated is a compliance checkbox. A pentest whose findings drive a remediation sprint that closes the top 5 critical vulnerabilities is a security improvement. The test is not the point.
3 lines Sage will not cross
#1
Never accept a "will fix later" response to a critical finding — critical vulnerabilities get a remediation owner and a deadline within 24 hours.
#2
Never deploy a third-party integration with access to production data without a security review.
#3
Never store credentials, API keys, or secrets in code repositories — not even private ones.
2 operating modes
Assessment
Risk identification, threat modeling, vulnerability scanning, pentest coordination — understanding the attack surface.
Response
Incident triage, breach containment, forensics coordination, communication management — structured response when something happens.
5 narrative cases — tacit knowledge encoded
The Secret in the Repo
A developer committed an AWS access key to a public GitHub repo. It was live for 6 hours before detection. $4,200 in unauthorized EC2 instances spun up. Implemented GitGuardian pre-commit scanning and a secrets rotation protocol. No secret commits detected in the subsequent 8 months.
The Vendor With Too Much Access
A marketing vendor had been granted read access to the entire customer database "for analytics." The access had persisted for 18 months beyond project completion. Least-privilege audit found 9 vendors with excessive permissions. All reduced to minimum necessary access within 2 weeks.
The Phishing That Worked
34% of employees clicked a simulated phishing link. The training had been "click next to complete." Rebuilt as scenario-based training with 5 real-looking examples and a minimum score to pass. Next simulation: 6% click rate.
The Critical Finding Nobody Owned
A pentest returned 3 critical findings. Report was shared in a Slack channel. 60 days later, none had been remediated — unclear ownership. Rebuilt process: every critical finding gets a named owner and a 30-day deadline assigned in the kickoff meeting, tracked in weekly security review.
The Breach Without a Playbook
A ransomware incident hit at 2am. No on-call procedure. No containment playbook. Decision-making by text message. 6-hour response delay cost 4× the cleanup cost. Built an incident response playbook with clear severity definitions, escalation contacts, and a containment checklist that every relevant person could execute without waiting for a security person.
System 1 · Domain Mastery
10 years of Security expertise — baked in at deploy
Named frameworks, tools at feature depth, hard-won judgment from 10 years in the field. What Sage knows without you telling them anything.
● Live
Security monitoring & alertingVulnerability managementAccess review & least privilegeGRC (governance, risk, compliance)Incident response planningPenetration testing coordinationSecurity awareness trainingVendor security assessmentSIEM & log analysisCloud security posture
↓ grounded in your business via
System 2 · Company Intelligence Vault (CIV)
Documents cited, never blindly absorbed — your context, always available
Feed Sage your SOPs, product catalog, website, and org chart. Every citation is traceable to source. Documents are held as an untrusted channel — referenced, not merged into core beliefs, so a bad document can't corrupt Sage's judgment.
Configure after hire
📄
Documents
PDFs, Notion, Google Docs — chunked and indexed
🌐
Website
Your site, read each session for current context
📋
SOPs & playbooks
Standard processes, always on
🏢
Org structure
Who is who, roles and reporting lines
📦
Product catalog
What you sell, how it's positioned
System 3 · Distillation Engine
Sessions compressed into wisdom — raw conversations never stored
After every session, a background job distills what was learned: preferences revealed, decisions made, beliefs updated. The raw transcript is discarded. Only the compressed judgment survives — which also structurally blocks prompt injection attacks.
After every session
⚗️
Preference extraction
Communication style, format preferences, quality standards — extracted, not copied
🔒
Injection barrier
Schema-level protection — injected instructions structurally cannot survive distillation
📐
Decision capture
What was approved, rejected, or escalated — and why
🔄
Belief updates
What was learned this session, and how it updates the working model
System 4 · Compounding Knowledge Graph (CKG)
Beliefs that decay, compound, and never silently overwrite each other
Bitemporal storage — every belief has an event_time and ingestion_time, so you can replay Sage's state at any past moment. Ebbinghaus decay: confidence in unvalidated beliefs drops over time, prompting confirmation rather than silently persisting stale data.
Compounds over time
🕰️
Bitemporal storage
Time-travel debugging — replay any past belief state
📉
Confidence decay
Stale beliefs lose confidence until re-validated by new sessions
⚠️
Conflict detection
New beliefs flag contradictions — never a silent overwrite
🧬
Belief evolution
Full audit of how the working model changed over months
System 5 · Relationship Memory + Emotional Intelligence
Knows everyone in your world — and never forgets the context that matters
Every customer, lead, partner, and stakeholder accumulates context over time. Communication style preferences, interaction history, implicit commitments, relationship dynamics — all retained so Sage never re-introduces anyone.
Builds after hire
🎯
Leads & prospects
Qualification history, interaction log, next steps
🤝
Customers
Deal context, preferences, relationship health
🔗
Partners
Context, agreements, relationship dynamics
💭
Communication style
How each person prefers to be spoken with
System 6 · Proactive Intelligence Network (PIN)
Sage watches specific signals — and briefs you before you ask
Event subscriptions, not cron polls. Sage watches domain-specific signals that actually matter for their function. When a signal fires, they queue a proactive brief rather than waiting for you to notice.
Always watching
Sage's 7 active watch patterns
WATCH
Critical vulnerability (CVSS >9) unpatched beyond 72-hour SLA
WATCH
Failed authentication spike on any production system (brute force or credential stuffing)
WATCH
Vendor with production data access not reviewed in >90 days
WATCH
Secrets/credential scanner alert from any repository
WATCH
Phishing simulation click rate climbing vs prior quarter
WATCH
Security incident response SLA breach (containment >4 hours for P1)
WATCH
New system deployed to production without a security review
System 7 · Action Layer — Trust Ladder
Four autonomy modes — capabilities earn trust, not time
Sage starts at Research Only. Each level requires demonstrated accuracy before escalating — not days on the calendar. You can also grant or revoke autonomy per-task type at any time.
Starts: Research Only
Research Only
Domain research and analysisBenchmarking and gap identificationData gathering and synthesis
Draft for Approval
Reports and plansPolicy and process documentationRecommendations with supporting data
Act with Notification
Routine operations from pre-approved playbooksAlerts and escalations
Fully Autonomous
None by default — owner unlocks after track record is demonstrated
System 8 · Meeting Intelligence Loop
Pre-brief → live notes → action items owned to completion
The gap no competitor fills. Most AI tools stop at the meeting. Sage briefs you before, captures decisions during, extracts action items after, and follows each item to completion — no decisions lost, no follow-through broken.
The gap closed
Before
📋
Pre-brief
Agenda, context, objectives — in your inbox before you walk in
→
During
✍️
Live notes
Structured notes with decision markers and open questions flagged
→
After
✅
Action items
Extracted decisions, assigned owners, deadlines — pushed to your tools
→
Until done
🔄
Follow-through
Tracks each item to closure. Flags stalled items before they become forgotten commitments
System 9 · Outcome Attribution
Tracks what worked, what failed, and why — so mistakes don't repeat
Sage owns their KPIs. Every outcome — good or bad — feeds back into their judgment. Failure memory is a first-class feature: what didn't work, the root cause, whether a retry under different conditions would be warranted.
Self-reporting
Sage's 6 owned KPIs
KPI
Mean time to remediate critical vulnerabilities (target: <30 days)
KPI
Phishing simulation click rate (target: <10%)
KPI
Open critical/high findings from last pentest (target: 0 critical at 30 days)
KPI
Vendor access review completion rate (target: 100% of Tier 1 vendors quarterly)
KPI
Security incident MTTD (mean time to detect)
KPI
Secrets exposure incidents per quarter (target: 0)
System 10 · Cross-Employee Cortex (CEC)
Persistent shared intelligence across every employee you hire
When Sage discovers something that changes how the business should operate, that organizational intelligence is available to every other employee — without a meeting, without a memo, without anyone remembering to tell anyone.
Grows with team
🧠
Shared org memory
What the business knows — not what one employee knows
🤝
Handoff intelligence
Pipeline context passed automatically to the next employee who needs it
⚡
No duplicate work
Research done once is available to all employees on the team
📡
Team-aware decisions
Each employee knows what the rest of the team is working on