Skip to content
UltimateTeam.ai Docs

CISO — Chief Information Security Officer

The Chief Information Security Officer (CISO) runs on the Sonnet (workhorse) model tier at 5 credits per call. The CISO is the security and compliance guardian: security event monitoring, threat detection, audit-trail hash-chain integrity verification, tenant-data isolation and privacy enforcement, security incident response, vulnerability scanning, access review with least-privilege enforcement, and the security aspects of compliance frameworks (SOC 2, encryption, key management).

Day in the life

The CISO runs continuously. Security event monitoring scans the configured rolling window (default 60 minutes) for event counts by category, anomaly signals, failed-authentication spikes, unusual data access patterns, and recommended immediate actions. The handler is gated to Enterprise via ADVANCED_SECURITY because the underlying SIEM rules and threat-intel feeds are an Enterprise capability; lower tiers get baseline monitoring.

Threat detection classifies emerging threats (intrusion attempts, credential stuffing, data exfiltration signals, insider threat indicators), assigning confidence scores, affected assets, attack vector, potential impact, and containment steps — output sorted by risk score.

Audit-trail integrity verification covers the platform’s hash-chain audit log: hash chain validity, sequence gaps, entries with invalid hash links, timestamp anomalies, and signs of log manipulation. The handler returns an explicit verdict with confidence and a list of any anomalies with location and severity. Privacy enforcement audits row-level security, cross-tenant access paths, PII handling, retention policy adherence, and encryption at rest — flagging any isolation violations with severity and remediation steps.

For active threats, incident response drives a structured plan: triage (root cause + confidence), containment (stop the threat now), eradication (full remediation with owners and timeline), status communication, and post-incident prevention. The handler emits security_incident_response_initiated.

Vulnerability scans identify CVEs in dependencies (CVSS ≥7.0), misconfigured cloud services, exposed secrets, insecure defaults, and missing security controls — sorted by severity with CVE IDs and remediation steps. Access review flags accounts with excessive privileges beyond least-privilege, dormant accounts (>90 days inactive), cross-tenant access anomalies, privilege-escalation paths, and shared credentials. Compliance security assessment maps the tech stack to the requested framework (default SOC 2) and surfaces gaps with control requirement, current state, severity, and remediation effort estimate.

Tools

Tools are registered via register_ciso_tools in src/agents/ciso/tools.py. The CISO additionally calls platform-wide helpers (Quality Gate, Audit Trail, Permission Enforcer).

  • AuditTrail / AuditRepository — Hash-chained audit log; the CISO verifies chain integrity at the configured cadence.
  • PermissionEnforcer — The Permission Enforcer’s Lua scripts in Redis back the rate-limit and spending-limit checks the CISO audits.
  • MemoryDefenseService — Embedding-poisoning defense (AGENT-01) for the memory-crystal subsystem.
  • ToolParameterValidator — Tool-injection detector (AIDEF-02) the CISO reviews when output anomalies surface.
  • quality_gate — Validates every CISO output (monitoring reports, threat classifications, incident responses, audit verdicts, compliance assessments) before delivery.
  • BehavioralGuardrailService — Behavioral guardrails the CISO can inspect when threat detection surfaces anomalous tool-use patterns.

Decision patterns

These are the entries in _CAPABILITY_DISPATCH from src/agents/ciso/capabilities.py.

  • SECURITY_MONITORING — Triggered hourly (configurable window); gated to Enterprise via ADVANCED_SECURITY.
  • THREAT_DETECTION — Triggered when monitoring or external signals indicate elevated risk; output sorted by risk score.
  • AUDIT_TRAIL_INTEGRITY — Triggered daily (configurable lookback); produces verdict + anomalies.
  • PRIVACY_ENFORCEMENT — Triggered weekly + on demand; checks RLS, cross-tenant paths, PII handling, retention, encryption.
  • INCIDENT_RESPONSE — Triggered by alerts; emits security_incident_response_initiated.
  • VULNERABILITY_SCAN — Triggered on every new scan; sorted by severity.
  • ACCESS_REVIEW — Triggered monthly; flags excessive privilege, dormant accounts, escalation paths.
  • COMPLIANCE_SECURITY — Triggered quarterly or on demand; default framework SOC 2.

Escalation criteria

  • Tenant plan lacks ADVANCED_SECURITY — SECURITY_MONITORING returns feature_gated.
  • Audit-trail verification surfaces a broken hash chain — escalates immediately to the chairman; the CISO does not silently repair.
  • Privacy-enforcement audit detects a cross-tenant data access path — isolation violation; chairman alerted; affected operations paused.
  • A vulnerability is found with CVSS ≥9.0 (critical) — chairman approval required for any remediation that touches production data flow.
  • Incident severity is critical — auto-escalates to the chairman with the structured response and a recommended approval pack.
  • Quality Gate flagged the output and auto-revise failed.
  • Action would exceed the CISO’s daily budget cap.

Example outputs

[Security event monitoring — last 60 minutes]


Event totals
- Authentication: 4,182  (failed: 14, 0.33%)
- Tool execution: 9,310
- Data access:    18,440
- Admin actions:  6


Anomalies
- 3× failed-auth spike from IP 203.0.113.42 — likely scripted; rate-
  limited at edge; no further action.


Recommended action: NONE (baseline activity; no escalation).
[Audit-trail integrity verdict — 24h lookback]


Overall: VALID  (confidence: 0.99)


Sequence: 41,902 entries; no gaps.
Hash chain: contiguous; every entry's hash_link validates.
Timestamps: monotonic; no anomalies.


No remediation required.
[Compliance security — SOC 2 (Type II observation window)]


CC6.1 — Logical access (control: enforce least-privilege)
- State: PARTIAL. 2 service accounts hold project-level admin where
  resource-level admin would suffice.
- Severity: medium.
- Remediation: rotate to resource-level role bindings (eng effort ~4h).


CC7.2 — System monitoring (control: detect anomalies, alert on threat)
- State: SATISFIED. SIEM rules + Permission Enforcer + audit-trail
  verification active.
- No remediation.


CC8.1 — Change management (control: authorized changes only)
- State: SATISFIED. Terraform + signed commits + 2-person review.

Sourced from src/agents/ciso/agent.py, src/agents/ciso/capabilities.py, src/core/security/audit.py, and src/core/security/memory_defense.py. Last reviewed: 2026-04-25.