Security remediation agent, engineer approval workflow

Overview

Synextra's engineers improve their clients' security every month. The hard part isn't the fixing. It's knowing where to start, for every client, from a list of recommendations that keeps changing. Prioritising took skilled engineering time every month, and it grew with every new client. Synextra is a Microsoft Azure specialist with 13 years of managing cloud environments for UK organisations, including law firms, conveyancers, and manufacturers. As part of the Synextra group, we designed and built this agent for its security team, and we run it alongside the tools they already use. The agent sets the priorities. Engineers make every change.

The Problem

A list that never stops changing, for every client, every month

For any business today, security and compliance must be planned, consistent, and on record. Customers check them. Insurers ask about them. Auditors and regulators expect to see them. Half of UK businesses lack basic cyber security skills in-house, so many hand that job to a managed service provider, which has to deliver it for every client, not just the ones who ask. The rules are changing too. The Cyber Security and Resilience Bill, now going through Parliament, brings managed service providers into UK regulation for the first time. A gap in a client's security is a gap in the service. Knowing what to improve starts with Microsoft's Secure Score, which lists suggested security improvements for each client. No two months look the same. New suggestions appear, Microsoft revises its advice, and clients change how they work. Some suggestions matter far more than others. An engineer had to read each client's list, judge what mattered most, size it, and schedule it. Then the same again for the next client, and the one after that. That's skilled time spent prioritising, not fixing, and every hour of it was paid for before any client was more secure. When prioritising depends on who does it, so does consistency.

The Solution

One agent. One job. Decide what matters most and hand it to an engineer.

We didn't build an agent that makes changes. We built one that decides what's worth changing and hands it to a person. It follows Synextra's own security process and works within the time each client already has in their managed service, whether that's two hours a month or two days. The goal is simple. The most important work gets done first, so every hour a client pays for counts. The workload stays within what's agreed, so the team can resource it and Finance can plan for it. Each month, the agent reads every client's latest recommendations, applies the same rules to each, and picks out the most important items that fit each client's allocated time, so consistency no longer depends on who's on shift. It adds each job to the task list the team already uses and pays for. Nothing new to learn. Nothing new to support. That's where the agent's part ends. It has no access to a client's systems, so an engineer picks up every job it raises, gets it approved, and makes the change. Control of every client's systems stays exactly where it was. We run the agent and monitor its output, and the team keeps the final say. One switch turns it off. We're also improving how it keeps track of completed work, so it won't suggest the same job twice.

The Impact

Skilled time back for Synextra. Planned security for every client.

Inside Synextra, engineers spend less time deciding and more time doing. The hours that went on prioritising now go on the improvements themselves and on more proactive work for clients. The agent handles every list the same way, so a growing client base no longer means a growing prioritising job. Security work becomes a known cost per client, not an open-ended one. Clients see the result. Every client now starts the month with its most important security improvements chosen and planned, to the same standard whatever its size. Security has always featured in every client's month-end report. Now it has a plan behind it. It's a programme, not a list. Every change is on record, so when anyone asks what's been done, the answer is already written down. Before letting an agent near its systems, any firm should know exactly what the agent is allowed to do. This one decides what matters most. That's all it does. A person still makes every decision about a client's security.