Axonius AI Workforce pairs asset intelligence with automated action

Axonius has announced Axonius AI Workforce, the latest expansion of Axonius AI. It enables organizations to deploy teams of Virtual Workers that monitor their environments, identify high-risk exposures and assets that deviate from their expected state, remediate issues, and report progress toward assigned goals. Actions requiring human-in-the-loop (HITL) approval pass through a structured checkpoint for review before execution.

Security and IT teams have more data than ever, but it is scattered across dozens of tools that were never designed to share data with each other. The constraint is no longer the volume of data, but the ability to ask questions across all of it, trust the answer, and take the right action. Most automation doesn’t close that gap. It runs on a schedule: a job triggers overnight, checks a condition somebody defined months earlier, and opens a ticket. This process holds up until the environment changes in a way nobody anticipated.

Everything else still lands on people, such as manually connecting an internet-facing critical asset to a compromised identity, identifying why an endpoint agent stopped reporting, finding the owner of an orphaned cloud workload, or chasing a ticket across multiple systems to confirm a fix.

Axonius AI Workforce: AI that earns its autonomy

The Axonius AI Workforce takes on the standing work that never gets done, because security and IT teams don’t have time. Every Virtual Worker acts on the decision-grade data in the Axonius Asset Cloud, not on one tool’s view of an asset or a standalone vulnerability finding. Actions that warrant intervention go through a structured approval checkpoint, rather than halting the work.

The Axonius AI Workforce includes:

• Outcome ownership: Each Virtual Worker owns a security outcome and tracks it over time, including threat intelligence, shadow AI, data completeness, post-quantum cryptography readiness, exposures triage, and more.
• HITL controls: Sensitive actions, including outbound communication and changes to connected systems, surface for approval before they execute. Routine work such as dashboard creation and asset labeling runs without review.
• Modes of autonomy: “Off” always stops for human approval, “Shadow” previews what the Virtual Worker would do, and “Live” applies the action automatically within set guardrails. Each job is tagged with a “recommended start mode” that follows Axonius best practices for running autonomous workflows.
• Cost transparency: AI credit usage and associated cost are visible to organizations, so security engineering teams can see what both their users and Virtual Workers spend.
• Trust details: Every Virtual Worker action is backed by an audit trail to clarify when an action is agent-driven versus human-driven. To ensure maximum data privacy, isolation, and control, every customer is provisioned with their own private LLM instance that runs entirely within their own dedicated environment.

“Every vendor is shipping AI agents right now. The question nobody is answering is what those AI agents are acting on. An AI agent that triggers a remediation workflow based on one vendor’s incomplete view of an asset is going to be wrong, and in security that matters,” said Moshe Ben Simon, chief product officer at Axonius. “We spent years building a platform that captures data from more than 1,400 bi-directional integrations. The Axonius AI Workforce is what you can safely build on top of that. We are giving security and IT teams back the time they used to spend chasing down bad data, and the confidence that every action taken is grounded in the full picture.”

“What’s notable about the Axonius AI Workforce is that it ties autonomous remediation directly to a unified, verified view of the environment, rather than treating AI as a bolt-on to fragmented tooling. Pairing autonomy with data integrity and human oversight where it matters is what will separate AI that security teams can actually trust from AI that just adds noise,” said Theresa Lanowitz, principal analyst, cybersecurity at Omdia.

Axonius AI: Generally available

The Axonius AI Companion (an evolution of the Axonius AI Agent) and the Axonius MCP Server, both introduced in July, are generally available alongside the Axonius AI Workforce. These three capabilities comprise Axonius AI.

• Axonius AI Workforce: Deploy a team of Virtual Workers that own a security outcome, monitor the environment to identify what doesn’t match an expected state, and carry out remediation. Each Virtual Worker owns a metric and tracks it over time, so security and IT teams can see whether things are improving, without building custom reports. A Daily Digest ranks what’s changed and what needs attention first.
• Axonius AI Companion: Ask questions in plain language, like “tell me which critical CVEs are on internet-facing assets handling PII, and enrich the answer with owner and business unit, ranked by risk,” with no proprietary query language required. Security and IT teams can then act on the answer in the same conversation: open a ticket, save a query, tag devices, and more.
• Axonius MCP Server: Feed Axonius asset data into AI tools, AI agents, and automations that organizations already run, so those tools work from trusted asset data, instead of stitching together answers from disparate tools.

Intuitive, natural-language capabilities like the Axonius AI Companion and Axonius AI Workforce, as well as integrations with the Axonius MCP Server, extend the power of the Axonius Asset Cloud to cross-functional stakeholders, including executive leadership, governance, risk, and compliance (GRC), and IT. As a result, rich asset intelligence is immediately accessible without requiring specialized platform expertise.

The Axonius AI Workforce, Axonius AI Companion, and Axonius MCP Server reason over the same decision-grade asset model that powers the Axonius Asset Cloud, which is a reconciled, deduplicated view of the entire estate across more than 80 asset and exposure entity types and is built from more than 1,400 bi-directional integrations. Axonius AI answers from real-world data, and if it can’t verify something, it says so without guessing.

“The value of data is measured in connections. Axonius AI connects those dots across our environment, turning tasks that once took hours into actionable insights in seconds,” said Mike Chasteen, staff security architect at Exemplar Luxury Group, formerly Saks Global. “Our team spends less time stitching together reports from disparate tools and more time acting on what actually matters. For a retail brand where trust and uptime are everything, that kind of speed and clarity makes all the difference.”