Assistive Actions
AI drafting inside the report editor — exec summaries, remediation, ATT&CK mapping.
Assistive Actions
Assistive actions are small AI helpers embedded where you work. They draft, suggest, or classify — you review and edit.
Where they appear
Assistive actions live inside the report editor, the finding editor, and the knowledge base. Each one is triggered by a button next to the field it works on.
The actions are:
| Action | Where | What it does |
|---|---|---|
| Draft executive summary | Report editor | Composes an exec summary from your findings |
| Draft methodology | Report editor | Writes a methodology section from a loaded playbook |
| Suggest remediation | Finding editor | Proposes remediation language |
| Map to ATT&CK | Finding editor | Suggests ATT&CK technique IDs |
| Summarize article | Knowledge base | Generates a one-line summary |
All of them use local Ollama. None of them send data externally.
Draft executive summary
Opens from the report editor. Reads every finding currently included in the report and composes an executive summary.
The summary:
- Opens with the engagement scope and timeframe
- Highlights critical and high findings
- Groups related issues
- Closes with overall risk posture
Before you click, make sure the finding selection is final. The draft reflects whatever findings are currently included.
After generating, the text appears in the executive summary field. Edit it to match your voice. The AI draft is a starting point, not a final answer.
Draft methodology
Opens from the report editor. Reads the loaded playbook on the engagement and writes a methodology section describing:
- Which framework was followed
- The phases of the engagement
- The tools used
- The testing approach
If multiple playbooks are loaded, the section covers each one.
The methodology draft is more formulaic than the exec summary — it's mostly template-filling. It's still useful as a starting point.
Suggest remediation
Opens from the finding editor. Reads the finding's title, description, and impact, then proposes remediation language.
The suggestion:
- Describes the fix in concrete terms
- References standard guidance where relevant
- Matches the technical level of the finding
This is a draft, not a recommendation. Every suggestion must be reviewed by you before it goes to a client. The model can be wrong. Your name is on the report.
Map to ATT&CK
Opens from the finding editor. Reads the finding and suggests ATT&CK technique IDs.
The suggestion returns one or more technique IDs with brief descriptions. Click a technique to add it as a tag on the finding.
ATT&CK mapping is one of the more useful actions — the model is good at recognizing patterns and matching them to the vocabulary. It's still worth double-checking for critical findings.
Summarize article
Opens from the knowledge base editor. Reads the article body and generates
a one-line summary suitable for the article's summary field.
Useful when you've written a long article and want a clean summary line without composing one manually.
How to use an action
- Open the field you want to fill — e.g. the executive summary in a report
- Click the Assist button next to it
- Wait for the draft to generate (a few seconds)
- Review the draft
- Edit it to match your voice and correct any errors
- Save
The generated text replaces whatever was in the field. If you had text before, you'll be asked to confirm.
Offline behavior
If Ollama isn't running or the model isn't available, the Assist button is disabled. A tooltip explains why:
"AI is offline — start Ollama first"
There's no queueing. Assistive actions either work or they don't.
Draft quality
The quality of a draft depends on three things:
- Model size — 3B models are usable but limited. 7B+ is noticeably better.
- Context — the more findings, playbook tasks, and articles the model can see, the better its draft.
- Prompt — ATHELOS's system prompts are tuned for security vocabulary.
If drafts are consistently poor, the usual fixes:
- Move to a larger model (7B or 13B)
- Add more content to the KB so retrieval has more to work with
- Edit the system prompt in Settings → AI
Editing the system prompt
Each assistive action has its own system prompt. View and edit them in Settings → AI → Assistive actions.
The default prompts instruct the model to:
- Match the tone of a professional pentest report
- Be concise and direct
- Avoid speculation
- Not invent CVEs or references
- Not invent ATT&CK IDs
You can tighten these if you find the model drifting. Loosen them if it's too constrained.
Limitations to know
Hallucination — the model may invent plausible-sounding details. Treat every draft as unverified until you read it.
Context blindness — the model only sees what ATHELOS passes it. If a detail about the engagement isn't in a finding or the playbook, the model won't know it.
Style drift — the model's voice won't match yours. The draft is a starting point; your edits make it consistent.
No client-specific knowledge — the model doesn't know who the client is or what their environment looks like. Don't expect it to tailor language to a specific client.
Cost
Zero. The model runs on your machine. The only cost is electricity and your time reviewing the drafts.
Where to go next
- RAG chat — conversational use of the KB
- Semantic search — the retrieval layer
- Generating reports — where these actions live