End-to-end automation of the operational layer behind a vulnerability management program. Scanner findings flow into Linear, get routed to owners, tracked against SLAs, escalated through exceptions, and reported to engineering weekly. Built entirely through Claude Cowork skills, scheduled tasks, and MCP integrations.
Aikido scans the codebase and files each finding as a Linear issue in the Vulnerability Management project. Issues carry severity, affected path, and package metadata.
For each unassigned finding, look up the affected file path in CODEOWNERS. If a single owner is clear, propose them. If ambiguous, search the internal knowledge base for the right team and escalate to the manager.
Assigned owners get a Slack notification with the finding details, severity, SLA deadline, and a direct link to the Linear issue. No one needs to check a dashboard to find out they have work.
Linear tracks SLA deadlines natively. The system surfaces findings approaching their deadline 7 days before breach and sends escalation notifications to prevent surprises.
When a finding breaches its SLA without resolution, the system creates an exception record in Linear's Security Exceptions project. The exception includes finding details, days overdue, and a bounded risk window.
When the engineering team fixes a finding and closes the Linear issue, the system auto-closes the corresponding exception and sends a status update to Slack. No manual cleanup.
Every Friday, a scheduled task queries all active findings, calculates severity breakdown, SLA compliance, and fixes since the last report. Drafts the message, waits for approval, then posts to #team-eng.
Retire lapsed exceptions, surface quiet cancellations, deduplicate findings across scans, and flag items closed without a fix. The register stays trustworthy because it cleans up after itself.
Traditional vulnerability management tools focus on scanning and dashboards. The operational work between "finding detected" and "finding fixed" is still manual: triaging, assigning owners, tracking deadlines, creating exceptions, reporting progress. This project automates that entire middle layer without writing a single line of application code.
Reusable skill files that encode reporting templates, triage routing logic, exception workflows, and program hygiene rules. Claude reads these and follows the patterns.
A Friday scheduled task triggers the weekly vulnerability report. Claude drafts the report from live Linear data and presents it for approval before posting to Slack.
Reads and writes to the Vulnerability Management project. Queries active findings, severity, SLA fields, assignees, labels. Creates exception issues in the Security Exceptions project.
Posts weekly reports to #team-eng. Sends assignment notifications to individual owners. Delivers SLA warnings, breach alerts, and status change updates.
When CODEOWNERS does not have a clear match, Claude searches the internal knowledge base to identify the right team and owner for the affected service.
Runs automated scans and pushes findings directly into Linear. Issues are labeled with scanner source (aikido or boa for manual/pen-test findings).
Drafts a complete status report from live data every Friday. Severity breakdown, SLA compliance, fixes since last report, and kudos. Posted to Slack after human approval.
Matches unassigned findings to owners via CODEOWNERS lookup. Falls back to the internal knowledge base when ownership is ambiguous. Proposes before assigning.
Surfaces findings approaching their deadline 7 days before breach. Sends escalation notifications so deadlines do not arrive as surprises.
Creates exception records in Linear when findings breach SLA. Bounded risk windows with expiration dates. Auto-retires exceptions when the underlying finding is fixed.
Builds trend reports from issue timestamps already in Linear. Open vs. closed, inflow vs. outflow, time to remediate, and SLA compliance. No snapshots to maintain.
Retires lapsed exceptions, surfaces quiet cancellations, deduplicates findings, and flags items closed without a fix. The register stays trustworthy because it cleans up after itself.
Slack messages for every meaningful state change: new assignments, approaching deadlines, SLA breaches, exception creation, finding closure, and exception retirement.
Aikido pushes findings directly into Linear. Manual and penetration test findings are filed with the boa label for separate tracking alongside automated scan results.