Secure AI

A practical guide to the Plans and Company Security Metrics sections of Sysdig Secure AI: risk-ranked remediation plans, target measures, and security KPIs.

A practical guide to the Plans section of Sysdig Secure AI.

Limits

Agent interactions with Sysdig Secure AI are currently capped at 500 requests per minute.

What the Plans Section Is For

Traditional vulnerability lists dump thousands of CVEs on you with no sense of what to do first. The Plans section flips that around: it uses Sysdig’s risk engine to rank remediation work by real-world impact — factoring in severity, whether a fix exists, whether the vulnerable package is actually in use at runtime, and whether the workload is network-exposed.

The output is an ordered queue of remediation jobs (one per vulnerable image) that a team can burn down, with progress measured against a concrete target metric you choose when the plan is created.

Mental model:

Plan  =  a goal (target measure)  +  a scope (zones/labels)
      →  Secure AI ranks the vulnerable images in scope by impact
      →  you work the ranked queue of Jobs
      →  each Job gets a Ticket and/or PR (an "artifact"), then is Closed
      →  the Plan's metric improves over time

Core Concepts

Concept	What it means
Plan	A saved, ongoing remediation effort with a defined goal and scope. This is the top-level object on the `/next/plans` page.
Target measure	The metric the plan is trying to drive down (such as Exposure Time). Every plan tracks exactly one.
Category	The grouping a target measure belongs to (for example, vulnerability findings). Determines which measures are available.
Scope	Where the plan applies — usually one or more Zones.
Zone	Sysdig’s semantically meaningful grouping of infrastructure (prod, staging, a business unit, etc.). Zones are the primary scoping unit.
High Value Assets (HVA)	Assets you identify by labels (namespace, cluster, workload) in the High Value Asset section under Settings. HVAs are typically the most mission-critical resources across your infrastructure.
Service Level Agreement (SLA)	SLAs are defined in the Policies section of Secure. You can have multiple SLAs, and each SLA’s scope is set in its definition.
Remediation Job	A unit of work — almost always “fix vulnerable image X.” Jobs are ranked by impact within the plan.
Artifact	A work-product record attached to a plan or a job: a Ticket (Jira/Linear/GitHub) or a pull request.
Activity timeline	The audit trail for a plan — when jobs changed state, when artifacts were attached, and when jobs were added.
Close	Marking a job done. The goal of every working session is to close jobs.

Target Measures (the Metric a Plan Drives)

When you create a plan, you pick the metric it optimizes. The common ones:

Target measure	What it counts	Pick it when…
`exposure_time_weighted`	Age-weighted sum of findings — older findings weigh more.	Vulnerabilities have been lingering for months and you want to attack the oldest risk.
`sla_compliance`	Urgency based on your SLA threshold.	You have a compliance deadline or an SLA to hit.

Using the Plans Page

Plans Page

The page lists your existing plans. For each plan you’ll typically see its title, the metric it tracks, its scope (zones), and its current progress.

From here you either open an existing plan or create a new one.

Create a Plan

Name the plan — something the team recognizes (for example, “Prod fixable+exposed”).
Choose a scope — pick the zone(s) the plan covers. Start with a zone like production; you can further narrow by namespace, cluster, or workload labels.
Choose a target measure — the goal metric described in Target Measures above.
Save. Secure AI ranks the vulnerable images in scope and builds the job queue.

Read a Plan’s Overview

When you open a plan, expect to see (top to bottom):

What — plan title, the measure’s display name + one-line explainer, and owner.
What this measures — why the metric matters.
Scope — the zones covered.
Current state — the current metric value and its trend (for example, “down −12 vs last week” — good for most measures, since lower is better).
Past activity — a summary of prior sessions: jobs remediated, tickets filed, and jobs closed (drawn from artifacts + the activity timeline).
Ranked jobs — the heart of the plan: a table of open and in-progress jobs, ordered by impact (internet-exposed first, then by severity).

The Ranked Jobs Table

Each row is one vulnerable image. Typical columns:

Column	Meaning
Image	The container image (for example, `quay.io/org/app:1.2`).
Ranking summary	Why it’s ranked here (for example, “9 fixable + exposed findings”).

Work top-down. The top job is the highest-impact fix. For each job the ideal outcome is to file a Ticket, then close the job.

Close the Loop

As jobs are fixed and closed, the plan’s target measure improves, and the Current state trend reflects it session over session. The activity timeline records everything for audit.

What the Company Security Metrics Section Is For

The Company Security Metrics dashboard provides a high-level overview of your organization’s security posture, tracking key performance indicators (KPIs) around High Value Assets (HVAs), vulnerability exposure times, SLA compliance, and overall finding trends.

Global Filters and Controls

Located at the top of the dashboard, these controls let you scope the metrics to specific environments or timeframes:

All zones: Filter the entire dashboard by specific security zones or logical boundaries.
SLA in: Filter metrics based on specific SLA criteria or definitions.
Group by: Organize the displayed data by specific dimensions (for example, team, cluster, or region). Set to None by default.
Reset: Instantly clear all applied filters to return to the default global view.
Timeframe toggle (bottom right): Switch between a 2W (2-week) or 30D (30-day) view. You can also toggle between local time and UTC.

Key Performance Indicators (KPIs)

The top row of cards gives you a quick snapshot of your current infrastructure scope and active policies:

Plan Policies (Active): The total number of security plan policies currently enforced.
Plans tracking HVAs: The number of active plans specifically designated to monitor High Value Assets.
HVAs: The absolute count of identified High Value Assets across your environment.
HVAs % of infrastructure: The percentage of your total infrastructure that is classified as a High Value Asset.

Metrics Sections

Vulnerabilities

This section tracks how long vulnerabilities persist in your environment before remediation.

Drop-down filter: Toggle between Weighted exposure or other calculation methods.
Main metric: Displays the current average exposure time (for example, 72.16d), alongside a comparison to the previous day (for example, -4.72, indicating a downward trend in exposure time).
Trend graph: Highlights daily fluctuations alongside a 7-day average line to help distinguish minor daily spikes from broader directional trends.

SLAs

This section measures how effectively your teams are meeting their remediation deadlines.

Drop-down filter: Toggle between First seen or other SLA milestones.
Main metric: Displays your current SLA adherence percentage (for example, 24.37%), showing whether compliance is improving or declining compared to the previous day (for example, +5.82).
Trend graph: Maps out your historical SLA adherence rate over your selected timeframe.

Findings

This section monitors the absolute volume of security issues discovered in your infrastructure.

Main metric: Displays the total number of active findings (for example, 3244), with a quick delta showing changes from the previous day (for example, -128).
Trend graph: Breaks down findings by severity layers — such as High and Critical — so you can see whether your overall risk surface is shrinking or growing.