Introducing Surf Assistant

Finding an exposure is the easy part. The hard part is answering who owns the fix and what else breaks when you make it. That answer is usually spread across tools, tickets and Slack threads, and it’s often out of date by the time you’ve pieced it all together.

Surf Assistant is now available in Surf AI. It’s built into the platform and answers questions about your Goals, Insights and exposures in plain English. What makes the Surf Assistant so powerful is that it reasons over the Context Graph, which maps your assets, identities and apps, who owns them, and how they connect, so its answers come with that context and asset intelligence built in.

What you can ask

Here are some of the questions Surf Assistant answers today.

Understand ownership and impact

• “Who owns this asset?”
• “What’s affected if we rotate this credential?”
• “Which critical Insights sit on assets with no owner?”

This is where the Context Graph shows up most. Surf already knows who owns what and how things connect, so it can point you to the owner of the fix (who isn’t always the asset owner) and show the Ripple Effect, meaning the downstream impact the fix itself will have, before anyone makes a change.

Find the exposures to fix first

• “Show Insights with critical priority.”
• “Filter all exploitable CVEs.”
• “Group Insights by priority.”

Priority is Surf’s ranking of what to fix first, so it’s a better starting point than severity alone.

Understand your Goals and Insights

• “What is this Goal trying to achieve?”
• “What do the Rules in this Goal detect?”
• “Summarize this Insight.”
• “Why was this Insight generated?”

Get quick answers

• “How many Insights are at critical priority?”
• “How many open CVEs are there for this asset?”
• “Show certificates expiring in the next 7 days.”

From answer to action

Surf Assistant answers questions and leaves changes to your team. When you ask about Insights you already have, it offers to help build a Workflow to resolve them, using the process your team defines. When you ask a broader question, it offers to create a Goal so Surf catches the same problem going forward. Nothing runs until your team approves it. It respects your existing RBAC permissions, so people only get answers about data they already have access to.

For example, ask which critical exposures sit on assets with no owner. Surf Assistant lists them, identifies who owns the fix for each, and shows the Ripple Effect of fixing it. It then suggests a Workflow that routes each one to the right owner through your team’s approved process.

Surf Assistant is available now for Surf customers, you can find it in the left navigation of your dashboard. Start with the Goal your team spends the most time on, and ask it what to fix first.

New to Surf? Book a demo to see what Surf Assistant can answer about an environment like yours.