AI is reshaping cybersecurity and changing how cyber teams operate. As data volumes and complexity grow, cyber experts are increasingly stretched, while AI-driven environments demand faster analysis and response. Organizations therefore need to leverage AI themselves to keep pace and focus expert time where it matters most.
At Wavestone, we are turning this shift into action. Our human-led, AI-accelerated approach combines cyber expertise with a growing range of in-house solutions designed around concrete operational challenges. Already tested and deployed across cybersecurity engagements, they help teams work faster, deepen their analyses and improve delivery while keeping experts firmly in control.
Built to adapt to any client environment, these solutions can connect to existing AI platforms or local models, without relying on a specific infrastructure or LLM.
In this article, we explore seven agents and the value they bring to cybersecurity teams. We don’t just talk about AI. We build it, test it and put it to work.
Security Advisory Mate (SAM): Security-by-Design and architecture review assistant
Teams can spend significant time on repetitive, low-value tasks. Security Advisor Mate, SAM, automates part of this workload while keeping cyber experts in control. It guides projects and cyber teams through the lifecycle, prepares security reviews, analyzes test reports and assesses key deliverables.
In practice, SAM reviews client architecture documents, assesses their quality and completeness, and checks alignment with client-specific or market security frameworks. It flags potential gaps and non-compliance points for expert validation. It can also examine vulnerability scans, pre-Go-live tests and security-gate evidence, while adapting to each client’s processes and architecture standards.
SAM makes Security-by-Design easier to scale. Teams could save up to one-third of their time while improving the consistency and completeness of security reviews. Cyber experts can then focus their attention on projects and decisions where their judgement matters most. Already tested in real client environments, SAM can be deployed in less than a day, works with cloud or local LLMs, and costs less than $2 per project, from intake to decommission.
Smart Identity Analyzer: IAM data quality improver
IAM projects often begin with analyzing large identity datasets, with inconsistent formats, duplicates and complex transformation rules. Preparing this information manually for recertification campaigns, migrations or wider IAM programs is both slow and error-prone. Smart Identity Analyzer examines identity files, maps their structure, detects inconsistencies and duplicates, and detects and validates transformation rules between systems.
Rather than relying on GenAI alone, it combines deterministic algorithms, data science and generative AI to analyze patterns, relationships and anomalies in the data. Teams gain a clear view of their discrepancies to resolve before they affect the wider IAM program. The solution runs locally, with no external API calls or persistence of prompts and outputs.
In practice, this can cut structure analysis from one day to half a day per identity file, and recurring data quality checks from one day to around two hours, representing up to 50%- and 80%-time savings respectively, allowing the project team to focus on improving the quality, instead of only computing it.
KoVex: Role mining advisor
Once identity data is reliable, KoVex takes the next step: turning access data into measurable risks and role-mining decisions.
Across thousands of identities, applications and access rights, even simple questions become difficult: who can access what, is that access justified, and which combinations create risk? KoVex uses the client’s own identity, application and access data to identify segregation-of-duty conflicts, unusual or dormant rights, and build role models from actual access patterns.
For each proposed role, teams can assess coverage, excess rights and residual access before deciding whether to retain or adjust it. Calculations provide evidence. AI assists. People decide. Role mining is based on reproducible calculations, while AI is used selectively where text interpretation adds value, such as improving data quality or naming roles. The final decision remains human and traceable.
KoVex can cut role-mining efforts by more than 50%, reducing a typical 20,000-identity exercise from around 30 to 5 days based on our project experience. It also matches the published optimum on 7 of 8 public role-mining datasets, with 100% coverage and zero excess rights, and can run entirely on the client’s server without exposing identities to a language model.
Booster RM: Risk analysis accelerator
Turning workshop discussions into structured analyses and client-ready deliverables is one of the most time-consuming parts of an EBIOS RM assessment. Booster RM accelerates the full EBIOS RM methodology with dedicated agents for each stage.
Using workshop minutes, transcripts and emails, it pre-populates EBIOS RM working files, from business needs and feared events to strategic and operational scenarios, attack paths and action plans. When information is missing, Booster RM asks for additional context before proceeding.
The solution targets a 30% reduction in writing time, giving risk experts more time to analyze scenarios and challenge results. It is also designed to adapt to other risk analysis methodologies, including client-specific approaches.
Web Recon Accelerator: Deterministic assistant for pentesters
Target exposure, network mapping, web server hardening and encryption checks are essential but highly repetitive, taking valuable time away from high-impact testing. Yet so-called “autonomous” AI pentest platforms can miss or hallucinate vulnerabilities, stray outside the authorized scope, and require sending critical security data to third parties.
Web Recon Accelerator automates these reconnaissance tasks while keeping auditors in control. All tests are run by a deterministic script: AI analyzes the results but never decides how the target is tested, preventing model errors or hallucinations from impacting the application. It then qualifies findings and pre-drafts vulnerabilities for reporting, which auditors can review and edit through a web interface. All data is processed by LLMs running directly on the auditor’s workstation, with no external calls, in line with our ISMS requirements. The script tests. AI analyzes. The auditor validates.
In practice, Web Recon saves on average 5 hours per pentest, which auditors can reinvest in hunting high-impact vulnerabilities such as access control flaws or code injections. Already used in many client engagements and adopted by our auditors, it runs entirely locally and incurs no token costs.
CrisisMaker: Crisis exercise stimuli creation studio
A strong cyber crisis exercise starts long before the simulation itself. Teams must build the storyline, design realistic injects, coordinate participants and prepare the debrief. CrisisMaker supports the full exercise lifecycle, from design to debrief.
Based on the client context, learning objectives, key scenario steps and participants, it helps consultants build the timeline and generate editable injects such as emails, messages, calls and social media posts. It can also review an existing exercise for coverage, pacing, actor balance and realism, enhance existing timelines, and turn the final storyline into an interactive or video debrief, while simultaneously increasing production value and stimuli variety.
CrisisMaker significantly shortens preparation time, reducing the time needed to create exercise stimuli by four to five times. Our teams spend less time producing and formatting content, and more time designing the right scenario, challenging participants and drawing meaningful conclusions.
CyberBench Orchestrator: Interview and analysis insight amplifier
One of Wavestone’s landmark publications is the , which provides market comparisons using the NIST pillars. Interviews conducted to complete this benchmark generate valuable information, but turning it into consistent, actionable results is another challenge. CyberBench Orchestrator brings the full workflow into one AI-enabled workspace, from interview transcripts to client-ready deliverables.
Moreover, it populates the assessment questionnaire, checks business rules and data consistency, and analyzes results. Scores and benchmarks can then be explored dynamically and exported in different formats (Excel, CSV, PowerPoint, etc.).
The workflow can be reduced from one and a half days of work to four hours and generate five times more insights. This allows teams to move faster from data consolidation to identifying the client’s strengths, weaknesses and priorities.
Taking AI in cybersecurity to the next level
Wavestone has developed a framework to identify, prioritize, implement and deploy the use cases that best fit your needs.
The solutions presented here are only examples of how AI can be used to accelerate existing processes and help teams work better and faster. But capturing the full potential of AI means going further. The next step is to scale beyond individual use cases by connecting AI capabilities and progressively evolving towards a more integrated, AI-enabled operating model.
Meet our cybersecurity and AI experts, see the solutions in action and explore where to start, where to accelerate, and how far AI could take your organization.
