Overview
The AI security checklist agent evaluates any resource within your Business Application against Azure security best practices and identifies hardening opportunities. It inspects the resource's current configuration, scores it across key security pillars, surfaces actionable findings with remediation steps, and estimates the time required to resolve them, all based on the resource's current configuration.
Business value
Security misconfigurations are among the most common causes of Azure incidents, yet identifying them manually requires deep familiarity with resource-specific best practices. The AI security checklist agent removes that dependency by automatically scoring any resource against applicable security controls and providing a prioritized remediation list, giving teams a clear, consistent baseline to act from without needing security expertise for every resource type.
How it works
When the agent is triggered for a resource, it inspects the resource's configuration and evaluates it across a set of security pillars applicable to that resource type. Each pillar is scored based on its current state:
- A pillar in good shape contributes its full points
- A pillar that needs review contributes half points
- A pillar that is at risk or failing contributes zero points
Together, the pillars produce an overall Security Score out of 100. The agent then identifies specific findings, ranks them by impact, and pairs each with a concrete remediation step and an estimated resolution time. It also highlights checks that already pass, giving a clear picture of both what needs attention and what is already in good shape.
Security pillars
The agent evaluates the resource across a set of security pillars specific to the resource type. Each pillar is one component of the Security score, and together they make up the 100-point total. For each pillar, the agent surfaces:
- What it is: A description of the security control and what it governs
- Why it matters: The risk or compliance implication if the pillar is not in good shape
- Your state: The resource's current standing against that pillar
Each pillar is assigned a state (Healthy, Needs Review, At Risk, or Unknown) which determines its point contribution to the overall score. Common pillars include Identity & access, Transport security, HTTPS-only, FTP deployment, Network access, and Governance, though the applicable set varies by resource type.
Security score
The Security score is built from all security pillars applicable to the resource type. Each pillar can contribute up to 16 points, for a total of 100. The score is rated as:
- Poor: Significant gaps across multiple pillars
- Fair: Some pillars passing, others at risk or unknown
- Good: Most pillars healthy with minor gaps
- Excellent: All pillars in good shape
Findings are tracked separately and do not double-count against the score. A pillar already marked at risk is not penalized again for the same issue in the findings list.
Findings
Findings represent specific security gaps identified in the resource's configuration. Each finding includes:
- Impact level: High, Medium, or Low
- Description: What is misconfigured and why it poses a risk
- Resolving step: A concrete action to fix the issue in Azure
- Estimated time: An approximate time to resolve the finding
An Estimated Total Time Required is shown at the bottom of the findings list, showing the total remediation effort at a glance.
Checks passed
Alongside findings, the agent surfaces controls that are already correctly configured on the resource, confirming what is already in good shape and does not require action.
Troubleshooting
-
The agent button is not visible for a resource
Cause: The AI Agents feature permission is not enabled for your role.
Fix: Ask your organization admin to enable the AI Agents permission for your custom role under Business Applications role settings. -
The Security score shows as Unknown for one or more pillars
Cause: The agent could not retrieve the data needed to evaluate that pillar. This typically occurs when the Azure resource type does not expose the relevant configuration property via Azure Resource Manager.
Fix: Review the pillar description to understand what it evaluates. If the data is genuinely unavailable for the resource type, the Unknown state does not affect the score the same way as At Risk. Re-run the agent after any configuration changes to confirm whether the state updates. -
The agent fails to generate a report on Private Hosting
Cause: The Azure OpenAI connection is not configured or has failed validation.
Fix: Navigate to Settings > OpenAI connection and verify the connection is active. See OpenAI setup in Turbo360 for setup steps. SaaS deployments do not require this step. -
Findings remain after remediation steps have been applied in Azure
Cause: The agent report reflects the resource state at the time it was last run. Applying a fix in Azure does not automatically update the report.
Fix: Re-run the agent after completing remediation steps to generate a fresh report that reflects the updated configuration.
FAQs
-
Does the Security score reset each time I run the agent?
Yes. The agent evaluates the resource's current configuration on demand each time it is triggered. The score reflects the resource's state at the time of the run. After you remediate a finding in Azure, re-run the agent to see the updated score. -
Are the security pillars the same for every resource type?
No. The agent evaluates pillars that are applicable to the specific resource type. A Function App and a SQL Database have different security controls, so the pillar set and the maximum achievable score differ accordingly. -
Does fixing a finding in Azure automatically update the agent's report?
No. The agent does not monitor the resource continuously. After applying a fix in Azure, re-run the agent manually to generate a fresh report that reflects the change.