humansecurity — Customer Success Report

1. SOC Alert Processing & Case Management

Description: End-to-end SIEM alert ingestion, observable extraction, deduplication, case creation, enrichment, and response orchestration. Alerts from Sumo Logic are ingested, normalized into Blink's case management system, deduplicated, enriched via VirusTotal, IPDB, URLScan, and Okta, then responded to via Jira tickets and Slack notifications.

Business Problem: Manual SOC triage is slow and inconsistent. This pipeline automates the full alert-to-case lifecycle — from ingest through to analyst notification — reducing MTTR and ensuring every alert is tracked, enriched, and escalated.

Category: SOC | Subcategories: Case mgmt & SOAR, SIEM & log pipeline monitoring, Alert enrichment / IOC lookup, Phishing detection & response

Key Integrations: Sumo Logic, Jira, Slack, VirusTotal, AbuseIPDB, URLScan, CrowdStrike, Okta, Check Point Harmony, Wiz, IPWhois

2. SIEM Log Health & Product Dashboard Monitoring

Description: A two-track monitoring framework. Track 1 (Log Health) runs daily AI-powered checks across six log sources — Aikido, Auth0, AWS, Datadog, BigQuery email records, and the HUMAN internal dashboard — alerting on ingestion gaps. Track 2 (HUMAN Dashboard) runs hourly, with an AI agent analyzing thirteen distinct anomaly categories across HUMAN Security's own product traffic (block rates, bot governance, spoofing, CAPTCHA outcomes, media abuse, etc.) and pushing findings to Slack.

Business Problem: Silent log pipeline failures mean delayed breach detection; product anomalies left unmonitored can indicate real-time attacks on customers. This use case eliminates both blind spots through continuous automated vigilance.

Category: SOC | Subcategories: SIEM & log pipeline monitoring, Agentic SOC

Key Integrations: Sumo Logic, Slack, Google Gemini, Glean

3. Agentic Threat Hunting

Description: A suite of AI agent-driven threat hunt playbooks covering CrowdStrike, Wiz, Okta, Sumo Logic, JAMF, and Jira. The hub-and-spoke model deploys specialized "Bot Activate" wrappers that accept freeform queries and invoke domain-expert agents. A scheduled "AI Hunter" runs daily, specifically hunting computers making connections to AI-tool domains — an emerging shadow-IT / DLP risk. Results are posted to Slack.

Business Problem: Manual threat hunting is infrequent and scope-limited. This use case operationalizes continuous agentic hunting across all key security data sources, enabling the SOC to detect novel behaviors without writing new queries.

Category: SOC | Subcategories: Agentic SOC, Threat hunting & detection

Key Integrations: CrowdStrike (Next-Gen SIEM), Wiz, Okta, Sumo Logic, JAMF, Jira, Slack, Gemini

4. GCP Cloud Security Monitoring

Description: Real-time GCP audit log surveillance across nine distinct threat categories — service account key creation, owner role grants, dangerous role assignments, public access grants, log sink tampering, org policy changes, API enable/disable events, and custom role modifications. Each "Invoke GCP …" playbook wraps a shared GCP Log Explorer search utility and is ready to be triggered on-demand or integrated into automated triage.

Business Problem: GCP privilege escalation and configuration drift are leading indicators of supply chain attacks and insider threats. This use case provides programmatic visibility into GCP's control plane with near-zero query-authoring overhead.

Category: Cloud Security | Subcategories: CSPM ingest & triage, Config audit & remediation

Key Integrations: GCP (Log Explorer, BigQuery), Wiz

5. Employee Separation Monitoring

Description: A comprehensive post-separation surveillance framework. When an offboarding ticket is created in the OH Jira project, Blink orchestrates deprovisioning across Akamai and Fastly CDN accounts. Separately, a scheduled AI agent runs every 30 minutes to pull all active offboarding tickets and execute parallel Sumo Logic searches per departing employee — scanning file access, outbound email, GitHub activity, Google Workspace device activity, and CrowdStrike USB events. A protected list prevents accidental deprovisioning of shared accounts.

Business Problem: Insider threats and data exfiltration risk peak during the employee separation window. Manual monitoring is infeasible at scale. This use case provides continuous, multi-vector surveillance and automated deprovisioning across CDN edge systems.

Category: IAM | Subcategories: Employee offboarding, Identity threat response, Identity lifecycle automation

Key Integrations: Jira, Akamai, Fastly, Sumo Logic, CrowdStrike, JAMF, Google Workspace, Slack, BambooHR

6. Vulnerability Management — Aikido

Description: Aikido Security vulnerability events are ingested via webhook at high volume (66,000+ events/year) and processed in real-time. A monthly scheduled report computes high/critical vulnerability trends and publishes a summary to a Google Sheet, enabling trend analysis by the security team.

Business Problem: Keeping up with a high-velocity vulnerability feed without missing critical findings. Automated ingest + trend reporting transforms raw scanner data into actionable intelligence without manual queue management.

Category: Vulnerability Mgmt | Subcategories: Vuln scanning ingest & report, Vuln scan lifecycle automation

Key Integrations: Aikido, Google Sheets, GCP

7. DevSecOps Code Security Review

Description: Every GitHub pull request that generates a Sumo Logic event triggers an automated security review workflow. The playbook parses the PR diff, creates a Jira ticket, appends an AI-generated security analysis as a comment, and evaluates whether the code change introduces security risks. This closes the loop between developer velocity and security review without requiring analyst involvement on every PR.

Business Problem: Security teams cannot manually review every code change at development speed. This use case scales security code review to match engineering throughput.

Category: GRC | Subcategories: DevSecOps compliance, Threat hunting & detection

Key Integrations: GitHub, Jira, Sumo Logic, Node.js (AI parsing)

8. Vendor Risk Management & Contract Monitoring

Description: Two complementary VRM tracks. First, a SecurityScorecard-integrated pipeline manages vendor portfolios by division, runs vendor risk reports, and attaches them to Jira VRM tickets — with an AI review loop for AI-generated vendor assessments. Second, Tropic contract approvals are monitored on a six-hour schedule to surface pending approvals before deadlines.

Business Problem: Vendor risk reviews are time-consuming and often inconsistent. This use case automates portfolio management, report generation, and AI-assisted review, while ensuring procurement contracts don't stall.

Category: GRC | Subcategories: Vendor risk & TPRM, Security metrics & reporting

Key Integrations: SecurityScorecard, Jira, BambooHR, Glean, Tropic, Slack

9. Access Review (UAR)

Description: A Glean AI-assisted access review pipeline for Aikido and GitHub. The UAR - AI Review Loop workflow triggers on Sumo Logic events, pulls the relevant Jira UAR ticket, queries current application users (Okta), and runs an AI-driven review — generating recommendations and posting them back to Jira. PTO awareness (BambooHR) is built in to avoid sending reviews to employees on leave.

Business Problem: Annual and periodic access reviews are labor-intensive. This use case automates the evidence collection, AI-assisted analysis, and review workflow, reducing reviewer burden while improving consistency.

Category: IAM | Subcategories: Access review & group mgmt, RBAC review & access mgmt

Key Integrations: Jira, Okta, GitHub, Glean, Slack, BambooHR

10. PCI Compliance & Regulatory Evidence

Description: A multi-system compliance evidence pipeline centered on A-Scend (the PCI evidence management platform). Jira tickets transition automatically into A-Scend evidence submissions via webhook. Snowflake SQL evidence collection, Confluence quarterly page building, and Jira activity ticket cloning are orchestrated through the MRC Quarterly Orchestrator — producing a fully automated compliance evidence package each quarter. A PCI Bot answers ad-hoc compliance questions via a Glean-backed AI agent.

Business Problem: PCI evidence collection is manual, error-prone, and consumes significant compliance team time each quarter. This use case automates evidence ingestion, quarterly Confluence page generation, and Jira ticket management, compressing multi-day work to minutes.

Category: GRC | Subcategories: PCI & regulatory monitoring, Compliance questionnaire, Security metrics & reporting

Key Integrations: Jira, Snowflake, Confluence, Google Sheets, Glean, A-Scend

11. DLP & Data Security

Description: Cyera DLP issues are ingested via webhook in real-time and recorded to a Blink table for downstream triage. A backlog seeder imports historical Cyera issues into Jira. A DSAR registration workflow appends new data subject access requests to a Google Sheet for compliance tracking. Glean log access events are monitored and alerted on Slack.

Business Problem: Data exposure findings from Cyera need immediate logging and tracking. Manual DSAR intake creates compliance risk. This use case automates ingestion at both ends of the data governance lifecycle.

Category: GRC | Subcategories: DLP triage & exposure resp, DSAR & privacy automation

Key Integrations: Cyera, Jira, Google Sheets, Slack, Glean

12. Customer Support Automation

Description: A fully automated customer support routing and AI-response system built on top of Jira Service Desk. The 000 - Entrypoint workflow catches every new Jira ticket update via webhook, validates routing criteria, uses Gemini AI to classify the request type, and dispatches to specialized sub-workflows. 001 - Initial Acknowledgement sends an AI-personalized acknowledgement. The 003 - 02 - Missed attack sub-workflow collects structured details about missed bot/attack events via an AI-driven Jira conversation loop. Glean is used to automatically record RFP submissions.

Business Problem: High support ticket volume with repetitive initial triage and acknowledgement tasks. This use case automates the full intake-to-routing pipeline and AI-assisted information gathering, reducing time-to-first-response and freeing analyst capacity for complex cases.

Category: Other | Subcategories: IT helpdesk & ticket routing, Agentic SOC

Key Integrations: Jira, Gemini, Google Sheets, Postgres, Glean, Sumo Logic, Slack

13. CRM & Lead Intelligence

Description: Salesforce lead records are automatically ICP-qualified via AI on ingest. A Glean AI model retrieves NAICS codes, annual revenue, and industry segments for each new lead and writes the enriched ICP designation back to Salesforce. A daily Account Planning job processes open opportunities to ensure coverage.

Business Problem: Sales team capacity is wasted on manual lead qualification. This use case applies AI scoring immediately on lead creation, enabling instant prioritization of high-fit accounts.

Category: Other | Subcategories: SaaS / IT administration, Customer registry & FinOps auto

Key Integrations: Salesforce, Glean, Google Sheets, OpenAI

14. Security Metrics & Reporting

Description: A set of scheduled reporting workflows that monitor Jira board health, track active and labeled tickets, flag SCR (Security Change Review) backlog items, and deliver daily AI-generated executive security summaries combining Sumo Logic data with Glean intelligence. Cloud license consumption (Wiz) is tracked daily to a Google Sheet.

Business Problem: Security leaders need regular visibility into ticket hygiene, operational metrics, and posture trends without manual report assembly. This use case automates the full metrics pipeline from data collection to Slack delivery.

Category: GRC | Subcategories: Security metrics & reporting

Key Integrations: Jira, Slack, Sumo Logic, Glean, Wiz, Google Sheets, BambooHR

15. IT Asset & Endpoint Management (JAMF)

Description: JAMF MDM inventory is queried, transformed, and routed across several IT operations workflows — syncing computer inventory into Snipe-IT nightly, resolving Slack IT-channel requests to JAMF computer records by email or serial number, comparing JAMF inventory against Control D device lists to flag unmanaged devices, and generating on-demand check-in compliance reports for a specific smart group. A Slack slash-command router gates access to this tooling based on IT team group membership.

Business Problem: IT and helpdesk staff need fast, self-service access to endpoint inventory data without direct JAMF console access, and asset records must stay synchronized across JAMF and the Snipe-IT system of record. This suite automates lookups, syncing, and reconciliation that would otherwise require manual console work.

Category: Other | Subcategories: Endpoint hygiene & MDM ops, IT helpdesk & ticket routing

Key Integrations: JAMF, Snipe-IT, Slack, Control D

16. Documentation Validation & QA Automation

Description: A comprehensive AI + Playwright pipeline that translates HUMAN Security product documentation into executable test cases, grounds them against the live product DOM, executes them end-to-end, and reports pass/fail status. Supporting diagnostic playbooks isolate specific UI behaviors — settings-category clicks, sidebar navigation, invite-user modals, bot-block pages, browser reconnect handling, and login flows — while a caching layer avoids re-deriving confirmed navigation chains on repeat runs.

Business Problem: Product documentation drifts out of sync with the live UI as features ship, and manually re-validating every documented workflow is impractical at HUMAN's release cadence. This use case continuously proves (or disproves) that documented steps still work against the live product, catching documentation debt before customers hit it.

Category: Other | Subcategories: DevOps & release automation

Key Integrations: Playwright (browser automation), Blink AI agents, Blink Tables (confirmed-chain cache)

17. Workspace & SaaS Administration

Description: Cross-cutting administrative automation for the tools the IT and program teams rely on day to day — a quarterly Slack workspace hygiene sweep that pages through admin APIs to identify and archive inactive channels (with guest and external-share detection safeguards and a Jira review subtask for anything excluded), a general Confluence content search utility, Jira connection health tests, and a lightweight Kanban-based project tracker (with an intake web form) for triaging BlinkOps Builder bugs, requests, and tasks across the MRC Audit, Slack Cleanup, Slack-Jamf, and Tech Docs initiatives.

Business Problem: Running dozens of automations across Slack, Jira, and Confluence requires ongoing administrative upkeep — stale channels accumulate, connections need periodic validation, and a growing automation backlog needs a lightweight tracking system. This use case keeps the underlying SaaS workspace and its own delivery backlog healthy.

Category: Other | Subcategories: SaaS / IT administration, IT helpdesk & ticket routing

Key Integrations: Slack (admin APIs), Jira, Confluence

18. Security Awareness Training Compliance (Wizer)

Description: A twice-weekly scheduled workflow cross-references BambooHR's who's-off list against the employee directory and pulls the Wizer security-awareness training master report to identify training gaps. A separate escalation flow queries PCI and Code training records and processes overdue completions. A shared "Is Employee OOO" check prevents nudges from being sent to employees who are out of office.

Business Problem: Security-awareness and PCI training compliance requires continuously cross-referencing HR status against training completion records — manual reconciliation is easy to let slip. This use case automates detection of training gaps while respecting employee PTO.

Category: SOC | Subcategories: Phishing sim & awareness

Key Integrations: Wizer, BambooHR

Strengths

Deep agentic AI investment. The organization has deployed Blink AI agents across nearly every security domain — CrowdStrike, Wiz, Okta, Sumo Logic, JAMF, Jira, and a dedicated L1 SOC email bot. The "Bot Activate" pattern makes agentic hunting accessible on-demand. The HUMAN Dashboard Agent running every hour across 13 anomaly dimensions is a particularly sophisticated production deployment.

Unique separation monitoring architecture. The employee separation use case is one of the most comprehensive seen in this segment. Running every 30 minutes with parallel Sumo Logic searches across five data planes (file access, outbound email, GitHub, Google Workspace, CrowdStrike USB) per departing employee demonstrates mature insider threat operations. The protected list guard prevents accidental deprovisioning at scale.

Own-product security as a use case. Unusually, Blink is being used to monitor HUMAN Security's own product dashboards (bot detection metrics, block rates, CAPTCHA outcomes). This "drink your own champagne" pattern, running 388 times in the last year, underscores the trust placed in the platform.

High-volume vulnerability management at scale. 66,224 Aikido events processed in 12 months — roughly 180/day — without analyst involvement. Paired with monthly trend reporting to Google Sheets, this represents a fully automated vulnerability intake pipeline.

PCI compliance automation depth. The MRC framework — spanning Snowflake evidence collection, Confluence quarterly page generation, Jira ticket cloning, and A-Scend integration — is a production-grade compliance automation stack, not a prototype.

AI-driven product documentation QA at scale. A 17-playbook suite translates HUMAN Security's own product documentation into Playwright test cases, executes them against the live product, and grounds results in the live DOM — 372 combined executions in its first period. This is an unusually mature application of Blink to internal product-quality assurance, extending the platform beyond traditional security use cases.

Persona Matching is now the highest-volume single playbook in the tenant. At 3,443 executions, the Salesforce Persona Matching workflow (AI-driven LinkedIn title → persona classification) runs more often than any other automation, reinforcing Blink's expanding role in real-time CRM enrichment alongside the existing Lead ICP Designation pipeline.

Gaps & Opportunities

Crowdstrike and Wiz ingestion paths have zero executions. The CM - Wiz Ingestion and CM - Crowdstrike ingestion workflows were built but have not run, suggesting the SIEM-based Sumo Logic path is the sole alert source in production. Enabling native CrowdStrike and Wiz webhook ingest would accelerate alert MTTR and reduce Sumo Logic dependency.

Phishing response has low execution volume relative to infrastructure. The Subflow - Phishing (40) and Subflow - Phishing Gmail (0) flows exist but run infrequently. The Check Point Harmony integration is connected but underutilized — the email remediation path (Restore Email - Harmony TEST) appears to still be in testing.

Access review playbooks built but not yet running. Aikido UAR Reject, Github UAR, and supporting Okta/UAR Table utilities all show zero executions. Only the UAR - AI Review Loop has been activated (18 runs). Completing the UAR pipeline would close a key IAM governance gap.

DLP triage stops at ingestion. Cyera issues are ingested (63 events) and added to a table, but there is no downstream triage, Jira ticket creation, or owner notification automation visible in the active playbooks. The Cyera backlog importer also has zero executions, suggesting the Cyera→Jira pipeline is incomplete.

GCP monitoring playbooks are built but idle. Eight "Invoke GCP …" wrappers (owner grants, dangerous roles, log sink tampering, org policy changes, etc.) all show zero executions. Only Invoke GCP Service Account Key Creation has been activated. Connecting the remaining GCP monitors to scheduled or event-triggered execution would complete the cloud control-plane coverage.

IT self-service and admin health-check tooling is built but not yet in active rotation. Jamf Lookup by Serial, Find computer by email, Confluence Search, and Jira Connection Functionality Test all show zero executions, suggesting several JAMF lookup paths and connection-health probes are staged but not yet driving day-to-day IT workflows.

Integration Ecosystem