Procedures that actually proceed.
Most security procedures live in a dusty binder, read only by auditors, ignored by the people doing the work. Adversarial embeds them directly into the AI that scores your risks and triages your incidents — then puts that prompt logic under real, quarterly governance. Our procedures are not aspirational framework-based templates that are divorced from reality. They are hand-written, intentional docs based on decades of actual security practice. The components of each procedure that inform AI scoring are clearly delineated, and you can add organizational-level customizations to the non-AI portions for compliance and documentation purposes, or to the AI portions to influence how risk management decisions are made 24/7.
- 1 Background and Purpose
- 2 Roles
- 3 Workflow
- 4 Scoring Guidelines
- 5 SLAs
- 6 Appendix
If your procedures only see daylight at audit time, they aren't procedures. They're wallpaper.
Every security program has them. Hundreds of pages of aspirational workflows, escalation thresholds, and decision trees that nobody reads, because nobody can. Analysts make the call from memory and habit, the binder collects dust, and at audit time everyone pretends the document on the shelf is the document in practice.
That gap — between the written procedure and the actual one — is the real compliance problem. Not just missing evidence, but evidence that doesn't hold up under decision by decision scrutiny. "It says here on page 63 that the analyst must preserve all logs and discussions but...". AI has given us the tool to solve that challenge. Embedded into prompts or model training, agents can conceptually follow your procedures to the letter all day, every day. But taken at face value, more times than not that approach highlights inconsistencies, fluff, and lack of reality in legacy procedures. We solve for that by crafting actionable, realistic, and defensible procedures based on decades of critical infrastructure cyber under intense regulatory scrutiny. You get procedures that work, provide outstanding program evidence, and are actually applied nonstop - with references and citations in all the work.
AI applies the procedure for you, on every risk and every incident.
Our platform uses procedures as live AI prompts — not reference material:
The procedure isn't the cover sheet for the work. It is the work.
Once a procedure has to run, you find out how unrealistic it actually was.
Plug a typical RAMP or ISMS into an AI and ask it to score your real risks. Half the rubric contradicts itself. The escalation tables assume roles you don't have. The severity definitions don't match the data you actually collect. None of this is malicious — procedures get written aspirationally, then never tested against reality.
Automation is the only honest stress test a procedure has ever gotten. So we wrote new ones worth running.
We ship the RAMP, the CIRP, and the rest — drawn from decades of elite cyber programs.
Adversarial customers get a complete set of procedural guidance written by operators who built and ran world-class programs at scale. Tight, testable, and tuned for execution rather than audit theater. No more downloading a generic template off the internet and praying.
Procedures evolve. So how do you control the change?
Even an elite procedure ages. New threats emerge. Regulators update guidance. Your business footprint shifts. A procedure that runs your scoring engine has to keep pace — or your whole risk register starts drifting from reality.
Most teams handle change in-house, which means tribal edits to a Google Doc that nobody reviews. In a highly regulated, AI-driven workflow, that's a non-starter. What logic got added? What got removed? When? By whom? Approved by what body? Without answers, every score and severity call your AI made yesterday is unauditable today.
And it isn't just you changing things. As your vendor and threat-intelligence curator, we're continuously refining the same procedures to reflect the latest priorities. That's value — until it's a change-control crisis.
AI Prompt Governance.
A first-class governance layer for the prompts that drive your risk and incident workflows. Versioned, locked, summarized, testable, and approvable on the same cadence as everything else in your program.
- Quarterly major versions. The RAMP, CIRP, CISP, and others lock at the end of each quarter as immutable doc versions.
- Prompt supplements between quarters. Smaller refinements ship as numbered supplements (e.g. RAMP v1.47) layered on top of the locked doc.
- Clear release notes. Every supplement ships with a plain-language summary of what it does and why — toggleable while you review.
- Organizational Supplements. Your team adds its own prompt logic to reflect your unique business, tech footprint, and risk appetite.
- Quarterly roll-up. At the end of each quarter we sweep our supplements into a proposed next major version with a written rationale — cued up for your governance body to review and approve.
Adversarial Supplements above. Organization Supplements below. Both fully exposed.
Two clearly separated layers — vendor-curated and customer-authored — each shown in full. Every procedure surfaces exactly which prompts are influencing your AI's scoring: who wrote each one, when, and why. Toggle anything off while you evaluate it. Nothing is hidden.
On major version updates, the supplements roll up. Your governance body sees a real summary — and decides.
When a new major version is proposed, the prior quarter's supplements get folded in and a clear release-note style summary is generated. For the first time, cross-functional leadership can see, in plain English, what changed in the logic driving their security department — opine on it, push back on it, and feed into it.
That is what real governance over a security program looks like — not slides about control programs, but visibility into the thinking that determined which incidents mattered in the first place.
Score. The button that lets you try a procedure version before it's live.
Every risk and every incident has an AI Score action. Click the chevron and pick the procedure version — RAMP v1 (Live), v2 (Proposed), even a specific 1.x supplement set — and see the resulting likelihood, impact, and urgency scoring inline. The pills shift to purple, an AI shimmer marks the affected fields, and nothing commits until you save.
Now you can actually evaluate a proposed procedural change against your real register before approving it. Pick a sample of risks. Score them under v2 with and without each candidate supplement. Bring those before-and-after results into the governance review. Approve from evidence, not vibes.
AI-generated logic is showing up everywhere. Governance has to catch up.
Vibe coding. Internal copilots. Marketing analysts spinning up automations. Engineers shipping workflows that nobody reviewed. Every organization is suddenly drowning in AI-generated logic that quietly governs real decisions. What prompts are running? What do they say? Who approved them? Most teams cannot answer.
That sprawl is coming for security too — and security is exactly where its consequences are most expensive. The first organizations to put AI prompt logic under deliberate, exposed, versioned governance will be the ones with defensible programs three years from now. Everyone else will be reconstructing decisions from logs.
Adversarial's prompt engine combines expert-curated procedural prompts from us with your organization's own supplements — fully articulated, exposed, summarized, testable, and approvable on a regular governance cadence. From day one. By design.
Bring your procedures into the light.
See AI Prompt Governance running on a real risk register.