AI for IT operations and management
Ultramarine Work reads the ticket exports, scan results, SOC reports and policies in your project folder, then returns the finished service desk report, staffing model, patch priority list or continuity plan in your team’s formats.
Nov-patch-priority.xlsxExampleNovember patch window, ranked findings
- F-0187vpn-gw-02, internet-facingCISA KEVPatch now
Upgrade the gateway firmware in the Nov 11 emergency window and confirm the fix with a rescan.
- F-0203web-prd-04, internet-facingPublic exploitScheduled
Apply the November cumulative update with the rest of the web farm in the Nov 18 window.
- F-0244sql-fin-01, internalException expired Oct 31Overdue
The owner has not renewed the exception, so patch it on Nov 18 or get a new sign-off.
- F-0261print-srv-03, internalCVSS 6.5Waiting
Patch it with the standard server group once the vendor ships the driver update.
How it works
- 1
Set up the IT folder
The folder holds the ticket CSVs your ITSM exported, vulnerability scan results, the SOC reports vendors sent, last year’s BIA and the policies overdue for review. Keep the files on the laptop or pull them in from SharePoint.
- 2
Ask for the deliverable
It sizes the queue by interval, ranks scan findings by exploitation and exposure, answers the SIG from your evidence library and drafts policies in your template. The staffing model shows its erlangs, and each figure cites the file it used.
- 3
Review every file it touched
Spot-check the numbers against the raw export, trace each finding to the scan it came from, and walk the CUEC map with the control owners. It drafts and checks, and the system owner signs off.
Inside the IT Operations & Management mode
Operating metrics and reviews
Turns the ticket export into the weekly ops report and the quarterly review deck: volume by category, SLA compliance by priority, backlog aging and MTTR.
Contact center staffing model
Sizes the service desk queue by interval with Erlang C, holds occupancy under 85%, then grosses up for shrinkage, so the staffing ask has a model behind it.
Business continuity and disaster recovery
The BIA sets RTO, RPO and MTPD for each system, and the DR test report shows actual restore time against target and restored-data age against RPO.
Business case and capital allocation
Assembles the capital request with current-state cost, run versus change split, build versus buy and a 5-year TCO, ready for the IT steering committee.
Security controls and policies
Drafts the acceptable use and data classification policies, maps controls across NIST CSF, SP 800-53, HIPAA and PCI DSS, and keeps the POA&M current.
Cyber risk assessment
Builds the annual assessment under NIST SP 800-30 or ISO 27005 and rates each threat by likelihood and impact against your asset inventory.
Security incident response
Writes the incident record as facts for counsel: a UTC timeline with separate detected, aware and classified timestamps, containment steps, notification clocks.
Vulnerability and threat reporting
Ranks scan results by known exploitation, internet exposure and asset criticality instead of CVSS alone, and flags findings past their patch deadline.
Security questionnaire response
Answers the SIG Lite or CAIQ v4 from your answer library. Every yes names its evidence file, and anything it cannot support stays open for you to answer.
Vendor risk and SOC report review
Reads vendor SOC reports for opinion, period, scope and exceptions, and maps each CUEC to the control your side actually operates.
- Office skills
- Excel, Word, PowerPoint, PDF
- Tools
- Read, edit and write files, Search files, Run code, Search and read the web, View images
- Connectors
- SharePoint, Google Drive, Gmail, and additional custom connectors
- House style
- Your fonts, layouts and rules, on every file
Ask it for
“Build the October service desk report from the ticket export: volume by category and site, SLA compliance by priority, and backlog items older than 14 days.”
Oct-service-desk-report.xlsx“Work out how many agents the Monday morning queue needs: 120 calls in the peak hour, 6-minute handle time, 80% answered within 60 seconds, 30% shrinkage.”
Service-desk-staffing.xlsx“Rank the 340 findings from the October scan for the November patch window: KEV hits first, then internet-facing servers, then expired exceptions.”
Nov-patch-priority.xlsx“Draft the business impact analysis for the top 12 systems from the department surveys, with RTO, RPO and dependencies, and flag systems with no tested recovery.”
BIA-2026-draft.xlsx“Review the payroll vendor’s SOC report: check the period and scope, list every exception and carve-out, and map each CUEC to the control on our side.”
Payroll-soc-report-review.xlsx“Write the incident record for INC-2291 from the firewall logs and chat export, with the UTC timeline, containment actions and notification clocks.”
INC-2291-incident-record.docx
Who it’s for
Everyone in an IT department, from help desk and desktop support through system, network and database administrators, SREs and architects, to IT managers, directors and CIOs.
Questions
Will auditors accept policies and evidence it drafted?
Your auditors decide, and their test is whether the document matches what you actually do, who approved it and when it was last reviewed. A draft policy is not the control. The version you reviewed and approved is. Its skills tell it to cite the source file for every statement and to flag anything it could not reconcile instead of guessing. You review every file it touched before anything reaches the auditor.
Can it help document a security incident for counsel?
Yes, the record states the facts counsel works from: a UTC timeline, the scope, the containment actions taken and the evidence preservation steps. It also lists the clocks that start at different moments, like GDPR’s 72 hours from awareness of a personal data breach and the four business days a registrant has to file an Item 1.05 8-K once it determines the incident is material. Counsel and management decide what gets disclosed, when and to whom.
Where does ticket and incident data go?
Ultramarine Work changes files only in the project’s folder. When a request needs it, it can read files elsewhere on your computer, never passwords, keys or app data, and you can turn that off in settings. The model runs on Paper Instruments’ servers, so the content it works on is sent there to be processed. Paper Instruments is SOC 2 Type II, and our security and compliance details are on our compliance page.