Security Exception Auditor
Finds the temporary exceptions that never ended
7 of 12 security exceptions need action, led by Payments API.
12 exceptions checked. 7 are flagged for 52 risk points in total; the longest-running has been past its limit or open for 771 days.
EX-105 is the first to deal with. Payments API has the most flagged exceptions.
The register says what was approved, not what is switched on: confirm whether each expired exception is still in force.
Why rows were flagged
- Over a year old31%
- No end date23%
- High risk, unmanaged23%
- Expired23%
Value flagged by System
- Payments API2
- Firewall2
- HR portal2
- ERP1
Exceptions to act on, worst first
| Item | System | Value | Days | Why |
|---|---|---|---|---|
| EX-105 | Firewall | 12 | 771 | No end date, Over a year old, High risk, unmanaged |
| EX-102 | Payments API | 12 | 597 | No end date, Over a year old, High risk, unmanaged |
| EX-101 | Payments API | 12 | 302 | Expired, High risk, unmanaged |
| EX-104 | HR portal | 6 | 332 | Expired |
| EX-106 | Firewall | 6 | 90 | Expired |
| EX-110 | HR portal | 3 | 545 | No end date, Over a year old |
| EX-108 | ERP | 1 | 691 | Over a year old |
What to do this week
- Close or renew EX-105 today: it is the highest-risk item on the list.
- Review every exception on Payments API: it carries the most flagged items.
- Put an end date on every open-ended exception and re-approve anything older than a year.
Do
- Give every exception an owner, a reason and an end date when it is granted.
Don't
- Don't let an exception renew itself: expiry should force a decision.
How to improve
- Add the compensating control for each exception so the next report can judge residual risk.
- Add the approver so the next report shows who signed off the oldest items.
Demo
Overview
Every security policy needs a way to say "not this time", so exceptions get granted: a firewall rule opened for a migration, multi-factor waived for a service account, an unsupported operating system kept alive for one application, a vendor allowed to connect without meeting the standard. Each is a defensible decision made by a competent person under real pressure, with an end date attached.
The end date is the part that fails. Nobody is measured on closing an exception, the pressure that created it disappears the moment it is granted, and the owner moves on. The register grows, and after a few years the organisation's real posture is its policy minus a list nobody has read end to end.
The compounding version is worse than any single entry. Three individually reasonable exceptions can combine into a path — an unpatched host, reachable from a segment opened temporarily, using an account exempted from multi-factor. Nobody granted that path. It exists because three separate approvals never met.
This agent reads the register against reality: what expired and is still in force, what is owned by someone who left, which compensating controls were promised and never implemented, and which combinations form a path. It grants nothing, changes nothing, and never asserts that anything is secure.
Benefits
The register stops growing
Because what should have closed becomes visible.
Paths found before an attacker finds them
The combinations nobody approved on purpose.
An honest answer for auditors
What is exempt, why, and for how long.
What it does
Finds expired exceptions still in force
Nobody is measured on closing one, and the pressure that created it vanished the day it was granted.
Checks the compensating control exists
Exceptions are approved on the promise of one. It is the first thing to go unimplemented and the last thing anyone checks.
Finds combinations nobody approved
Three reasonable exceptions that together form a path. No single approver ever saw it, because no approver saw the other two.
Traces orphaned exceptions
Owned by someone who left. An exception with no owner is never going to be closed by anyone.
Reports the posture honestly
Your real standard is the policy minus this list, and almost nobody has ever read it end to end.
Grants and changes nothing
It touches no control, no rule and no register entry, and never states that anything is secure.
What this changes
What this changes about your week
- It takes over
- Reading the exception register against what is actually still in force.
- Done today by
- Nobody end to end. Exceptions are granted individually and never read together.
- How often
- Quarterly on paper; in practice at audit.
- Typical manual effort
- Every entry needs its expiry, owner and promised compensating control checked.
Why Cybersecurity in particular. Nobody is measured on closing an exception, and the pressure that created it vanishes the day it is granted. Worse, three individually reasonable exceptions can form a path no approver ever saw.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Security Exception Auditor has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Requirements
Integrations
No integrations required.
Before you start
- The exception register: what, why, who approved, expiry, compensating control
- The systems and accounts each exception applies to
- Current staff list
- Whether each compensating control was implemented, where recorded
- Requires the All-Access plan or higher
Use cases
Quarterly exception review
What expired, what has no owner, what has no control.
Before certification
What an assessor will ask about first.
After a reorganisation
Which exceptions lost their owner.
Risk committee reporting
The real posture, not the policy.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Does it change security controls?
No. It touches no control, no firewall rule, no policy and no register entry. Closing an exception can break a live system, and that decision belongs to the people who own it.
Does it scan or test our systems?
Never. It performs no scanning, probing or testing of any kind. It reads the register and the records you supply.
How does it find combinations?
By checking whether exceptions touch the same system, account, or network path. It reports the combination and what it would allow, and states plainly that it is reasoning from the register rather than from a tested attack path.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent