AI Scan Planner

Daily portfolio review that picks which targets to scan today and explains why. Contestable by the operator at every step. Complements Scan Schedules and manual scans.

The AI Scan Planner is a daily decision layer that watches every target in your portfolio, weighs risk against budget, and proposes a scan plan for the day with a written rationale per target. The operator can accept the plan, force a scan, veto a target for the next cycle, or pause the planner with Vacation Mode.

It does not replace manual scans or Scan Schedules. It runs alongside them as a third source of dispatches, driven by signals the operator does not have time to monitor every day.

The page at Scans → AI Scan Planner opens with the daily rationale:

Daily portfolio review picks which targets to scan today and explains why. Every decision is contestable: force a scan, veto next cycle, accept a proposal, or pause the planner with vacation mode.

How a decision is made

Every cycle (default daily, 02:00 in the org's time zone), the planner walks every target in your portfolio and computes a priority score between 0.000 and 1.000.

The score combines four weighted inputs per target:

The weights are tuned per organization. Operator feedback (force, veto, apply, ignore) nudges the weights in the direction of what the team has historically accepted. The team's signal becomes part of the model.

Action types

Per target, the planner emits one of these actions:

The rationale column is always plain English. Examples:

• Maintenance pulse within daily quota.
• Below threshold; skipped to preserve budget.
• Environment profile changed; full scan recommended.
• GraphQL detected; suggest api_jwt profile.

Daily quota

The planner is budget-aware. Each plan tier ships a daily quota that caps how many autonomous dispatches the planner runs in 24 hours:

Above the quota, the planner emits Skip rows so the operator can see what was not scanned and why. Force-scanning a Skip row is one click; the operator decision overrides the quota for that target.

The portal page

Scans → AI Scan Planner.

Header

Decisions table

Contextual buttons

Every button click is captured in the customer-facing Audit log, with the operator identity and the original decision.

Per-target template suggestion

The planner reads the per-host Environment Profile produced by every scan and proposes a more appropriate template when the detected stack disagrees with the current configuration.

The suggestion is silent for 30 days per (target, template). After 30 days, the planner will propose again if the signal still holds.

Auto-apply safety net

If the operator does not click Apply or Ignore on a profile proposal by the time the planner dispatches the next scan for that target, the planner applies the suggested template itself. The target's preferred_scan_template is updated; an audit row is written with actor = ai_scan_planner and a auto-applied note.

This is by design. The cost of letting the planner adapt is lower than the cost of running the wrong profile against a stack that changed.

Drift radar

Outside the daily quota, the planner monitors environment profile drift. When the per-host fingerprint changes (new technology, auth surface change, protocol change), and the change is observed outside business hours, the planner emits a full-scan dispatch flagged as drift_dispatch to capture evidence before the change propagates further.

Drift dispatches do not count against the daily quota. They are audited under ai_scan_planner_drift_dispatch.

Vacation mode

Pauses the planner for up to 60 days. Useful for:

• Maintenance windows where the team does not want autonomous scans.
• Holidays or quiet periods where alerts should stay silent.
• Investigations where the team wants to control the scan timeline manually.

Vacation mode does not pause Scan Schedules or manual scans; it only pauses the autonomous decision layer. Drift dispatches respect vacation mode.

How it fits with Scan Schedules and manual scans

The three dispatch sources are independent and complementary:

A target can be touched by all three in the same week. The planner respects a 24-hour cooldown between any two dispatches of the same target, so a manual scan in the morning will not be redundantly re-scanned by the planner at 02:00.

Plan availability

The current quota is shown as a pill on the planner page and can be raised by request.

Audit and contestability

Every planner action is auditable:

• Each decision row is append-only with full rationale.
• Every operator override (Force, Veto, Apply, Ignore, Vacation toggle, Master toggle) writes an entry in the customer-facing audit log with actor = human.
• Every autonomous action (dispatch, drift dispatch, auto-apply) writes an entry with actor = ai_scan_planner.
• Vetoes carry a 30-day TTL and are revocable at any time.

The audit log is queryable from Audit Log in the portal sidebar, filterable by ai_scan_planner_* action codes.

What it does NOT do

• No black-box decisions. Every action has a rationale and is contestable in one click.
• No surprise scans. Cooldown prevents re-runs within 24 hours; quota prevents budget blowout; vacation mode pauses the planner entirely.
• No takeover of manual scans or schedules. The planner is a third dispatch source, not a replacement.
• No external data sharing. All signals are computed from your own targets, findings, and Environment Profiles. The planner does not call out to third-party intelligence to score a target.

Where it lives in the portal

• Scans → AI Scan Planner: the decisions page.
• Scans → Scan Schedules: cron-driven scans (independent).
• Audit Log: filterable history of every planner action.
• Settings → Usage → AI Scan Planner tab: daily quota usage, monthly AI-driven scan count, vacation mode state, pending proposals, active vetoes.