Security teams are some of the most overloaded in any organization. Every alert needs triage. Every quarter brings another access review. Compliance audits demand documentation that nobody has time to write. And when an actual incident happens, the team switches to firefighting mode while the backlog of routine work grows.
The IT & Security starter pack gives your team 10 AI recipes and 4 multi-step workflows that handle the repetitive documentation and analysis work — so your security professionals can focus on the decisions that require human judgment.
What’s in the starter pack
10 Recipes
The pack includes recipes for the tasks that consume most of a security team’s writing time:
- Security Audit Checklist — Generates a structured audit checklist from your infrastructure description and compliance framework
- Incident Response Plan — Produces a detailed incident response plan with roles, communication protocols, and escalation procedures
- Access Review Report — Creates a formatted access review report from user access data, flagging excessive permissions and dormant accounts
- Vulnerability Assessment Summary — Summarizes vulnerability scan results with severity rankings, remediation priorities, and business impact analysis
- IT Policy Writer — Drafts IT policies (acceptable use, BYOD, data classification, etc.) from a topic and organizational context
- Phishing Awareness Email — Generates employee-facing security awareness communications based on current threat landscape
- System Change Request — Produces a structured change request document with risk assessment, rollback plan, and approval requirements
- Disaster Recovery Plan — Creates a disaster recovery plan from infrastructure topology and business continuity requirements
- Security Training Quiz — Generates assessment questions from security topics with varying difficulty levels
- Compliance Gap Analyzer — Identifies gaps between your current controls and target compliance framework requirements
4 Workflows
The workflows chain recipes together with conditions, approvals, and loops:
- Security Incident Response — Alert triage → response plan generation → post-incident report → stakeholder notification. Critical alerts bypass the queue and page the on-call team immediately.
- Access Review Pipeline — Pulls access data → generates review report → flags anomalies → routes to manager approval. Runs quarterly on a schedule.
- IT Change Management — Change request generation → risk assessment → CAB approval gate → implementation checklist. The approval step pauses the workflow until the Change Advisory Board signs off.
- Vulnerability Remediation — Scan summary → prioritized remediation plan → assignment routing → verification checklist. Loops through each critical vulnerability with specific fix recommendations.
Example: Security Incident Response workflow
Let’s walk through the flagship workflow step by step.
Trigger: A security alert comes in — suspicious login activity from an unusual geography.
Step 1: Alert Triage. The workflow takes the alert data (source, severity, affected systems, timestamp) and runs it through the incident classification recipe. Output: structured triage with severity level, affected scope, and recommended response tier.
Step 2: Response Plan. Based on the triage output, the Incident Response Plan recipe generates a tailored response plan. Not a generic template — it references the specific systems affected, the type of threat detected, and your organization’s escalation procedures.
Step 3: Condition Check. If severity is critical, the workflow pages the incident commander via PagerDuty and skips to immediate response. For lower severity, it continues through the standard documentation flow.
Step 4: Post-Incident Report. After containment, the workflow generates a structured post-incident report with timeline, root cause analysis, and preventive recommendations — while the details are still fresh, not three days later from memory.
Step 5: Stakeholder Notification. A phishing awareness or incident summary email is generated and sent to affected teams, calibrated to the audience (technical detail for engineering, business impact for executives).
Integrations and scheduling
The IT & Security pack connects to the tools your team already uses:
- Jira — Create and track remediation tickets automatically from vulnerability findings
- Slack — Post alert summaries and incident updates to your security channel
- PagerDuty — Trigger pages for critical incidents directly from workflow conditions
- GitHub — Link security findings to code repositories and pull requests
Two built-in schedules keep recurring work on track:
- Quarterly Access Review — Automatically triggers the access review pipeline every quarter, so you never miss a review cycle
- Weekly Vulnerability Triage — Runs the vulnerability assessment summary weekly, keeping your remediation priorities current
Real results
“We used to spend two full days each quarter just preparing access review documentation. Now the pipeline generates the reports, flags the anomalies, and we just review the exceptions. What took 16 hours now takes 2.”
— IT Security Lead, mid-market SaaS company
Teams using the IT & Security pack typically see:
- 70% reduction in time spent on compliance documentation
- 4x faster incident response documentation (generated during incidents, not after)
- Consistent quality across all security reports, regardless of who triggers them
Get started
Install the IT & Security starter pack from the department page. It sets up all 10 recipes and 4 workflows, configures the suggested schedules, and walks you through connecting your integrations. Your first security audit checklist is one click away.