Fortress — Customer Success Report

1. Employee & Contractor Lifecycle

Description: Fully automated onboarding and offboarding for both employees and contractors, orchestrating identity provisioning and deprovisioning across Active Directory, Microsoft 365, Okta, Duo, and Atlassian. Each lifecycle event is triggered by a Freshservice ticket approval and closes with an automated summary note — no manual steps required.

Business problem solved: Manual onboarding and offboarding are error-prone, slow, and leave orphaned accounts that create security and compliance risk. Automation ensures consistent, auditable execution across every required system within minutes of a ticket approval.

Integrations: Microsoft Intune, Active Directory (WinRM), Microsoft Entra ID, Microsoft Graph, Exchange Online, Okta, Duo, Atlassian User Management, Jira, AWS WorkSpaces, Freshservice

2. Security Operations & Alert Management

Description: A full SOC automation stack spanning alert ingest, observable enrichment, and incident response. Alerts from CrowdStrike, Splunk, and Microsoft Defender XDR are ingested into Blink's case management system, observables are automatically extracted and routed through 13+ enrichment modules (covering IP, hash, URL, domain, username, and device types), and confirmed threats are dispatched to dedicated phishing and malware response flows.

Business problem solved: Security analysts are overwhelmed by alert volume and manual triage. This automation handles ingestion, deduplication, enrichment, and response routing end-to-end — reducing analyst workload and mean time to respond.

Integrations: CrowdStrike, Splunk, Microsoft Defender XDR, Microsoft Defender for Cloud Apps, Blink Case Management, VirusTotal, AbuseIPDB, URLScan, Okta, Microsoft Entra ID, Google Workspace, Microsoft Outlook, Bash/Whois

Alert Ingest & Processing

Response Flows

Observable Enrichment

3. Vulnerability Lifecycle Management

Description: A scheduled, end-to-end vulnerability management pipeline that syncs open vulnerabilities from CrowdStrike into a master Blink table, reconciles inserts/updates/deletes, and generates per-department HTML reports distributed to stakeholders via email. Runs automatically twice a week; the table can also be synced on demand.

Business problem solved: Vulnerability data scattered across tools creates blind spots and manual reporting bottlenecks. This pipeline maintains a single source of truth and ensures each department receives a targeted view of their open risk exposure — without analyst involvement.

Integrations: CrowdStrike, Blink Tables, Bash/Python

4. AI-Driven HR Process Automation

Description: Automates two HR workflows triggered from Freshservice tickets: an AI-powered job intake flow where an agentic bot drafts a formatted job description document from ticket inputs and emails it to HR, and a SharePoint automation that creates folder structures and moves templates whenever a new job description is initiated.

Business problem solved: HR teams spend significant time drafting job descriptions and organizing file structures manually. These workflows deliver a polished job description document within minutes of ticket submission and keep SharePoint organized automatically.

Integrations: Freshservice, Blink AI Agents, SharePoint, Microsoft Outlook, Python/DOCX

5. Contract Lifecycle Automation

Description: Automatically moves contracts from Salesforce to IronClad when triggered by a Salesforce webhook event — downloading the attached file, parsing contract metadata, and routing the document through the defined legal workflow. A parallel flow handles AI-assisted document contract review, and a third flow manages secure delivery of FSO-related documents to the security team.

Business problem solved: Manual contract routing between sales and legal causes delays and handoff errors. Automation ensures contracts reach IronClad immediately upon Salesforce event, with full metadata intact.

Integrations: Salesforce, IronClad (via email), Microsoft Outlook, Microsoft Entra ID (for FSO group verification)

6. Executive & Business Reporting

Description: A suite of AI-powered and scheduled reporting workflows. The centerpiece is "Thursday Special" — team leads submit weekly status updates (blockers, priorities, meetings, time off) which an AI agent synthesizes into an executive briefing, stored in a Blink table and emailed every Sunday morning. Complementary flows deliver CEO summaries from Salesforce data, monthly time tracking reports from Harvest, and weekly executive email notifications.

Business problem solved: Executive reporting requires significant time gathering and synthesizing information across teams. These automations replace manual aggregation with AI-generated insight delivered on a consistent cadence.

Integrations: Blink AI Agents, Blink Tables, Salesforce, Harvest, Microsoft Outlook, Fortress Platform API

7. Software Deployment & IT Self-Service

Description: Automated software deployment via PDQ Connect, fulfilling Freshservice-ticketed software installation requests end-to-end: lookup the device, find the package, deploy, and poll for completion. Includes a self-service portal workflow for employee-initiated installs and a software assurance check workflow. Supporting utilities handle Freshservice custom object queries and email delivery.

Business problem solved: Software installation requests create IT helpdesk backlog and delay employee productivity. Automation fulfills requests directly from the ticket without IT intervention.

Integrations: PDQ Connect, Freshservice, Microsoft Graph (email), Bitbucket (SSH)

8. Finance Operations Automation

Description: AI-powered finance analysis workflows. The Finance Spend Validation Master Workflow is fully active — triggered by a Salesforce webhook, it chains four specialized AI agents (SQL Query Agent, Price Analysis Agent, Legal Assistant, Report Assembler Bot) to validate vendor spend against budget, contract terms, and pricing before emailing an approval report. Two additional workflows remain in development: the Finance Database Analyzer, which uses four AI agents for spend anomaly detection, coding validation, month-end close assistance, and account variance narration; and a Beta workflow for invoice validation against Bill.com and QuickBooks.

Business problem solved: Finance operations require significant manual analysis time across multiple systems. The Finance Spend Validation Master Workflow now automates vendor spend validation end-to-end — from Salesforce trigger through AI-driven cost and contract analysis to email-based approval — while the remaining AI agents are being brought into production for anomaly detection and invoice validation.

Integrations: Blink AI Agents, Salesforce, Blink Tables, Bill.com, QuickBooks, PowerShell, Microsoft Outlook

9. Vendor Risk & Software Assurance Automation

Description: Automates vendor risk management using the Fortress Platform API — pulling the master vendor registry and risk-rank scores, analyzing SOC2 reports with AI to identify complementary user entity controls (CUECs), running AI-driven software assurance ticket analysis triggered from Freshservice, and syncing active vendor records into OpenGRC on a monthly schedule.

Business problem solved: Vendor security reviews — pulling risk data, reading SOC2 reports, and keeping GRC systems in sync — are manual and time-intensive for the security team. These automations pull vendor data programmatically and use AI to analyze compliance documents in minutes instead of hours, while keeping OpenGRC continuously synced with the vendor registry.

Integrations: Fortress Platform API, Freshservice, Claude AI (Bash), Blink Tables, OpenGRC (HTTP)

Strengths

Mature, multi-system IAM lifecycle. Both employee and contractor onboarding and offboarding run fully automated, touching AD, Entra ID, Okta, Duo, Atlassian, Exchange Online, Intune, and Freshservice in a single orchestrated flow. With 15 onboardings and 9 offboardings in 12 months, this is a high-trust, production-grade operation.

Well-architected SOC stack. The SOC automation follows a clean modular design: four ingest connectors → Process Alert orchestrator → Enrich Observables router → 13 typed enrichers → Response Main Router → dedicated response subflows. The 60 enrichment routing calls and 32 processed alerts confirm the pipeline is live and running.

Broad and growing AI agent adoption. Agentic workflows now span executive briefing (Thursday Special), job description drafting (Job Intake), CEO summary generation (Alex Report), security activity analysis (User Device Activity Search), a four-agent spend validation chain (SQL Query Agent → Price Analysis Agent → Legal Assistant → Report Assembler Bot in Finance Spend Validation Master Workflow, 26 executions), and Claude-driven document analysis for SOC2 CUEC extraction (30 executions) and software assurance ticket review (SAP Engine). This is one of the more diverse AI automation footprints in production.

Contract automation at scale. 26 contracts automatically routed from Salesforce to IronClad is a high-value, measurable outcome — replacing a manual handoff between sales and legal that is both time-sensitive and error-prone.

Vulnerability management is fully scheduled. The twice-weekly Vuln Management Engine runs a complete cycle — sync from CrowdStrike, reconcile the master table, and generate per-department HTML reports — without any analyst involvement.

Vendor risk automation now includes AI-driven document analysis. SOC2 CUEC Analysis ran 30 times in its first period — using Claude to extract complementary user entity controls directly from vendor SOC2 reports — while Update Vendor Information from Risk Rank and Fortress Platform to OpenGRC Vendor Sync keep the vendor registry and risk scores current automatically.

Gaps & Opportunities

SOC enrichment modules are built but dormant. The Enrich Observables router fired 60 times, but all 13 individual enrichment subflows show 0 executions. This suggests the router may be making conditional calls that rarely satisfy enricher trigger conditions, or the routing logic needs tuning to activate the enrichment library. Resolving this would convert the existing investment into measurable IOC coverage.

PDQ software deployment is partially live. Freshservice: Install Software using PDQ (6 executions) and Deploy software using PDQ Connect (4 executions) are now running in production, but the original four PDQ subflows (ticket intake → device lookup → package deploy → completion polling) still show 0 executions. Consolidating onto the active workflows and retiring the unused duplicates would reduce maintenance overhead.

Finance Database Analyzer and BETA invoice validation remain unused. The Finance Spend Validation Master Workflow is now live and processing vendor spend approvals end-to-end (26 executions), but the four-agent Finance Database Analyzer and the BETA: Finance Validation workflow against Bill.com/QuickBooks have never run. Extending the same AI-agent pattern that powers spend validation would help activate these quickly.

Phishing and malware response flows not yet triggered. Both response subflows have 0 executions. With 32 alerts processed through Process Alert and 30 routing calls through the Response Main Router, the response layer exists — but either no alerts have matched phishing/malware classification or the routing conditions need review.

Document Contract Review disconnected. The Salesforce-triggered Document Contract Review workflow has 0 executions while the parallel Contract to IronClad flow (same trigger type) ran 26 times. These likely need to share the same Salesforce trigger event or the connection may not be configured.

User Device Activity Search unused. This CrowdStrike + Defender + AI investigative workflow has 0 executions. As a security-critical capability for device forensics, enabling this for incident response would extend the SOC automation coverage significantly.

Integration Ecosystem

The automation stack spans 20+ distinct integrations across seven domains: