autobotAI gives you three ways to run security work. They share the same integrations, memory, guardrails and audit trail, so the choice is about the shape of the job, not about which product to buy.
| Ad hoc with Optimus | Workflow | Harness | |
|---|---|---|---|
| Shape of the job | One-off question or task | Known steps, repeated | An outcome that spans many runs, tools and owners |
| Who decides the path | Optimus, with you in the conversation | You, step by step | Agents, inside the boundaries you set |
| Runs on | Your request | A schedule, an event, an API call or a portal request | Several triggers at once, continuously |
| Predictability | Varies with the question | Same path every run | Same goal, path adapts to the evidence |
| Cost per run | Varies | Flat and predictable | Varies with the work found |
| Auditors see | The conversation and its tool calls | The same path every time | Each agent's runs, approvals and the risk register |
| Start with | Investigate with Optimus | AI Builder or the library | Optimus |
Choose a workflow when
- You already know the steps, and want them to run the same way every time.
- Volume is high and cost must stay flat, such as alert enrichment or nightly posture checks.
- An auditor or regulator needs to see a fixed, repeatable path.
- The decision points are clear rules, with AI used for enrichment, scoring or summaries inside the flow.
Workflows can still use AI: an AI evaluator classifies or scores, and an AI agent node reasons with tools at one step, while the overall path stays fixed.
Choose a harness when
- The goal is clear but the path isn't, such as "close every critical finding on this application".
- The work spans many tools and teams, and different findings need different routes.
- Agents need to hand work to each other: an intake agent deduplicates, a resolver works the fix, a re-test agent proves it.
- The job never really ends, such as continuous exposure management or chasing owners until fixes ship.
Examples by team
| Team | Workflow | Harness |
|---|---|---|
| SOC | Enrich every phishing report, quarantine confirmed copies after approval, reply to the reporter | Contain an active incident: correlate signals, preserve evidence, contain with approval, keep stakeholders updated until closure |
| Identity | Weekly access review: compare rights with usage, send removals to each manager | Joiner-mover-leaver hygiene across every app: find leftover access, chase owners, revoke with approval, re-check after 7 days |
| GRC | Collect evidence for a control every month and file it | Keep a framework audit-ready: chase evidence owners, track SLAs, route exceptions to the risk register |
| Cloud | Nightly scan for public buckets with a fix routed to CloudOps for approval | Posture closure across 800 accounts: find owners, draft fixes, follow up and escalate on SLA, verify |
| AppSec | Open a ticket for every new critical finding with its owner | Find, fix and verify: scan nightly, take findings from other tools, open pull requests, re-test and update the register |
Grow from one to the other
Most automations move along this path:
- Ad hoc. Try the job with Optimus and see what it actually takes.
- Workflow. When the steps settle, ask Optimus or AI Builder to turn them into a workflow, and keep critical decisions deterministic.
- Harness. When one workflow isn't enough to reach the outcome, let Optimus assemble a harness. Your existing workflows become tools the harness's agents call.
You don't have to choose once: a harness usually contains workflows, and a workflow can hand work to an agent at a single step.
Set autonomy for either
The shape of the job and the autonomy of an action are separate choices. A harness can still require approval for every change, and a workflow can run a low-risk action on its own. Set autonomy per action, by risk. See Autonomy and approvals.