AI for security and GRC work
Put the scan exports, policies, control matrix, vendor SOC reports and incident files in one folder, then ask for the triage grid, the crosswalk, the board pack or the questionnaire draft.
Cyber-board-pack-Q3.pptxExampleAsk it for
“Draft the incident record for the February 12 business email compromise, with the UTC timeline, accounts touched, containment steps and evidence collected.”
Incident-record-2026-02-12.docx“Sort the March 14 Nessus export, KEV-listed findings first, then findings with public exploits, then the rest by asset criticality, each with a due date.”
Vuln-triage-2026-03.xlsx“Fill out this customer’s SIG Lite from our answer library and flag every answer our SOC 2 report and policies do not support.”
SIG-Lite-response.xlsx“Check the payments vendor’s SOC 2 Type 2 for the opinion, exceptions, carve-out subservice orgs, the CUECs we own, and a stale period with no bridge letter.”
Vendor-SOC2-review.docx“Crosswalk our 38 SOC 2 controls to NIST CSF and ISO 27001 Annex A, and list controls with no owner, no evidence or wording that conflicts with the policies.”
SOC2-crosswalk.xlsx“Turn the quarter’s incidents, the KEV backlog and the open POA&M items into the Q3 board pack, with each disposition recorded as treated, accepted or past due.”
Cyber-board-pack-Q3.pptx
How it works
- 1
Assemble the program folder
Scan exports, the policy set, the control matrix, past questionnaires with their answers, vendor SOC reports, the risk register and incident tickets exported to PDF, in the folder structure your team already keeps.
- 2
Ask for the deliverable
You get the triage grid with due dates, the crosswalk with gaps called out, the questionnaire draft with answers tied to evidence, or the board pack. Where the folder does not support something, it says so instead of inventing the answer.
- 3
Review and decide
Every claim points back to a file, so review means checking the work against the evidence instead of rewriting from nothing. You accept, edit or reject each one, and no response, policy or assessment moves without your sign-off.
Inside the Security & GRC mode
Security incident response
Turns ticket notes, alert exports and chat threads into an incident record with a UTC chronology, affected accounts and the notification clocks that follow.
Vulnerability and threat reporting
Reads scanner exports and ranks findings by exploitation status, exploit maturity and asset criticality, then proposes patch order and due dates from policy.
Cyber risk assessment
Runs the annual assessment under NIST SP 800-30 or ISO 27005, with threats to each asset, likelihood, impact, current controls and the treatments left open.
Security controls and policies
Maps controls across SOC 2, ISO 27001, NIST CSF, SP 800-53, HIPAA and PCI DSS, and flags SSP and POA&M statements the folder’s evidence does not support.
Security questionnaire response
Drafts SIG, CAIQ and custom questionnaire answers from the approved library, ties each answer to its evidence and lists the questions the folder cannot back.
Vendor risk and SOC report review
Pulls opinion, period, exceptions, carve-out subservice orgs and CUECs from vendor SOC reports, and names what your side must still control, not the vendor.
Audit PBC and evidence requests
Assembles evidence for SOX and SOC 2 PBC requests, with the full population, never a subset, plus the completeness and accuracy support auditors test.
Regulatory and compliance analysis
Writes breach notification analyses, DPIAs and sanctions ownership reviews, and ties every conclusion to the rule or regulation behind it.
Business continuity and disaster recovery
Builds the BIA with RTO and RPO per essential function, writes the continuity plan and documents the tests that show whether the objectives hold.
- Office skills
- Excel, Word, PowerPoint, PDF
- Tools
- Read, edit and write files, Search files, Run code, Search and read the web, View images
- Connectors
- SharePoint, Google Drive, Gmail, and additional custom connectors
- House style
- Your fonts, layouts and rules, on every file
Who it’s for
Security analysts, incident responders, vulnerability and threat analysts, penetration testers, GRC, IT risk and third-party risk analysts, security managers and CISOs.
Questions
Will it claim controls we can’t evidence?
No, it works only from the files and prior answers in the folder, and it flags every question with no support there instead of guessing. Each answer carries its source, and you can see which claims rest on the SOC 2 report and which rest on nothing. A questionnaire answer is a representation your company is on the hook for, so the tool drafts and a person who knows the controls decides what goes out.
Vendors send us SOC reports under NDA. Can we feed them in?
Yes, put the report in the project’s folder and the tool reads it like any other file. It does not check NDA terms, because the confidentiality call is not the tool’s to make. The content is processed on Paper Instruments’ servers, so treat Paper Instruments like any third party that handles confidential material and let your legal or compliance team decide what may be sent.
Can it write the incident summary behind our SEC filing?
Yes, it drafts the record, with the UTC chronology, scope, containment actions and evidence preserved, and it keeps confirmed facts separate from assumptions. The materiality determination is a management and counsel decision, not one the tool makes, and the Item 1.05 clock runs from that determination rather than from discovery. Have counsel direct the drafting, because privilege and disclosure decisions are theirs.
Does running incident files through AI waive privilege?
No, the tool cannot grant privilege, and courts treat what you share with an AI platform as a disclosure that can waive it. Whatever it works on goes to Paper Instruments’ servers for processing. In a February 2026 federal case from the Southern District of New York, material typed into a consumer chatbot was neither privileged nor work product. The tool organizes facts and drafts. Counsel decides what the record says, what stays confidential and what gets disclosed.
Where does our data go?
Ultramarine Work changes files only in the project’s folder. When a request needs it, it can read files elsewhere on your computer, never passwords, keys or app data, and you can turn that off in settings. The model runs on Paper Instruments’ servers, so the content it works on is sent there to be processed. Paper Instruments is SOC 2 Type II, and our security and compliance details are on our compliance page. Whether it trains on customer data is not stated in our documentation, so ask Paper Instruments.