The AI analyst
Ask questions about a customer's security in plain English, analyse findings and draft remediation plans, from any page.
Updated
On this page
The AI analyst is a built-in assistant for your MSP team. It reads the customer's data with its own tools, runs scope-locked live checks, and drafts analyses and plans. It never changes anything by itself: changes become approval requests that a person approves.
AI is included with Revo: there's no key to add or subscription to manage. Usage counts against your plan's monthly allowance (see What the AI can see).
Where to use it
- AI conversations (⌘K): full-page conversations, in the portfolio or a customer's workspace.
- Ask AI from any page (below).
- The AI button on a finding: finding analysis and remediation plans.
- Typing a question in ⌘K offers Ask AI: "…" about the page you're on.
Ask AI from any page
The Ask AI button in the bottom-right corner, ⌘J (Ctrl+J on Windows) or Ask AI about this page in ⌘K opens the assistant beside the page. On a wide screen it docks to the right and the page makes room; drag its left edge to resize it (double-click to reset). On a smaller screen it opens over the page. Esc or ⌘J closes it.
- It knows which customer, and what you're looking at. The first chip shows the conversation's scope: a customer's name, or All customers. The next shows the page that's shared, for example Using: Finding: No CSP header. Click × on the page chip, or turn off Include page, to ask without it.
- Suggested questions fit the page: on a finding, Explain this and how to fix it; on a device, Why is this device non-compliant?; on the attack surface, What should I fix first?; on patching, Which devices are most at risk?.
- Recent conversations for the customer you're in are listed underneath. A conversation stays open as you move between pages; each message shows the page you sent it from.
- Approval requests appear in the panel and can be approved or rejected there.
- Open in AI analyst opens the conversation on the full page.
A conversation is either pinned to one customer or about all customers:
- Pinned to a customer is the default in a customer's workspace. The analyst only reaches that customer's data. If you move to another customer's page, the panel says so and offers a new conversation for that customer.
- All customers is the default on portfolio pages that aren't about one customer, and you can choose it in a customer's workspace by clicking × on the customer chip before the first message (the dashed chip pins it again). The analyst can then read any customer of your workspace, with your permissions. The conversation stays open as you move between customers, and each message shares the page you send it from.
The scope is fixed once the conversation starts. Either way the analyst stays inside your workspace and your role's permissions. See What the AI can see for which protections apply only to pinned conversations.
What it can do
| Task | Result |
|---|---|
| Questions about posture and findings | A chat answer, with the records it looked up |
| Finding analysis | Verdict, priority, exploitability and verification steps |
| Remediation plan | Ordered steps with scripts (PowerShell or Bash), verification and rollback, as a draft for review |
| Live checks | DNS, TLS, HTTP security headers and email security, only against the registered domains of the customer checked |
| Report summaries | The written summary in generated reports |
| Posture and insights | The customer's pillars, act-now list and cross-module insights, and the related context of a record |
| Agent fixes | Which catalogue fixes apply to a finding or device, their risk, who can run them, what users will notice, and how past runs went |
| How-to questions | An answer with a link to the knowledge-base article that covers it |
| Internet search | Vendor advisories and guidance, with sources (see Internet search) |
| Proposed changes | Finding status changes, running an assessment, creating a PSA ticket: filed as approval requests |
Fix with agent
The analyst can't start or cancel an agent fix. When one applies, it proposes it: it explains the action, its risk, who can run it (high-risk fixes are for owners and admins), what users will notice, its impact and how to undo it, and links to the finding or device page where you review exactly what will run and start it with Fix with agent. If the fix can't run (an agent older than 0.8.0, remediation off for the customer or on the device), it says why.
Good questions to ask
- "What should we fix first this week, and why?"
- "Summarise the dark web exposure for this customer."
- "Is this finding a false positive? How do I verify it?"
- "Which devices are missing the KEV updates?"
- "Why are updates failing for this customer?" (it checks the insights)
- "Can the agent fix this? What's the risk?"
- "Write the steps to move DMARC to quarantine safely."
Who can use it
Owners, admins, technicians and analysts. Customer-portal users don't see the assistant. If AI isn't available for your workspace, the panel says so and links administrators to Settings → AI.