How KeyValue helped build Axari’s AI Twin, a Claude-powered security teammate
KeyValue engineered Axari’s AI Twin end-to-end. Built for security teams, this AI teammate works inside Slack, investigates issues across existing tools, and follows them through to verified fixes, with human approval for every risky action.
- Client website
- axari.ai
- Headquarters
- San Jose, California · global SaaS
- Industry
- Cybersecurity · AI agents
- Engagement
- Product & AI engineering partner, alongside Axari’s team
- Built for
- CISOs, security engineering, GRC and security operations teams
- Key technologies
- ClaudeClaude Agent SDKMCPPythonReactAWS
A teammate that does the security work, not another dashboard
Axari was founded by Prasen Shelar, the first product manager at Demisto (later acquired by Palo Alto Networks). His belief was simple: security teams don’t need more alerts. They need someone who can act on them and see the work through.
Axari partnered with KeyValue to bring that vision to life: an AI Twin for every security professional.
More alerts than teams can handle
Security tools surface issues faster than teams can investigate, prioritise, and assign them.
Too much chasing, too little fixing
Much of a security lead’s week goes on status updates, reminders and audit evidence.
Closed tickets, unresolved risks
Marking a ticket as done doesn’t guarantee the underlying security issue has been fixed.
Building alongside Axari’s team
KeyValue worked with Axari’s team to build the platform and AI Twin, with Claude at the centre from the very first commit, and continues to ship new security workflows.
Axari AI Twin
The security teammate itself: reasoning, multi-step workflows, memory and proactive intelligence on Claude, working inside Slack, Teams and other work platforms.
Configuration dashboard
Where teams set up their Twin, connect integrations and manage settings
Integrations
50+ security, identity and productivity tools
Safety & trust
Approvals, message checks and a full audit trail
Cloud & operations
Secure hosting, agent sandboxing and monitoring
For a security team to trust an AI agent, it needs more than the ability to act. It needs accountability. That principle shaped how we built the Twin: operating within the owner’s permissions, requiring approval for high-risk actions, and keeping every action traceable.
An AI Twin that carries security work from alert to verified fix
One Twin per security professional, not another tool. It lives in Slack, Teams and the other platforms teams already work in, learns the people, systems and priorities around its owner, and handles the legwork while they keep the decisions.
Finds what matters
Pulls findings from security scanners and alerts, assesses exploitability and asset ownership, and prioritizes the issues that need attention first.
Does the work in your tools
Creates and assigns tickets, prepares fixes, and gathers audit evidence across 50+ tools, operating within the owner’s permissions.
Follows through until it’s done
Reminds owners, escalates stalled tasks, and increases urgency as deadlines approach, without sending duplicate reminders.
Confirms the fix worked
Closes an issue only after a fresh scan verifies that the vulnerability has been resolved, then reports back to the owner.
One pattern behind every workflow
- 01
Trigger
Alert, ticket or schedule
- 02
AI Twin
Reasons with Claude
- 03
Human approval
For risky steps, by default
- 04
Action
In the owner’s tools
- ✓
Verified close
Checked and recorded
Built for how security teams actually work
60+ ready-made tasks & workflows
From a quick risk summary to full vendor onboarding.
Automations in plain language
Describe a recurring job in a chat message, and the Twin runs it.
Remembers people & ownership
Knows who owns what, and what was already discussed.
Daily morning brief
The few things that matter, from every connected tool.
Proactive intelligence
Surfaces slipping work, alerts and unprepared meetings before anyone asks.
Human in the loop
Risky actions need approval by default, and teams can configure which ones.
Making an AI agent safe to run on real security systems
Getting an AI model to respond is the easy part. The real engineering challenge was making the Twin safe and reliable enough to act within a customer’s systems.
Acts only within authorized limits
The Twin uses the owner’s existing permissions and seeks human approval before taking high-risk actions, keeping people in control.
Keeps sensitive information protected
Every outgoing message is checked for secrets and personal data, with sensitive information removed or corrected before it leaves the system.
Long-running work that keeps its place
Security workflows can run for days across many steps and people. If a system restarts midway, the Twin resumes from the last completed step instead of starting over.
One customer. One secure environment
Each customer’s Twin operates in its own isolated environment with dedicated credentials, keeping access and operations separate.
Built on a modern, Claude-first stack
AI
- Claude · Opus, Sonnet, Haiku
- Claude Agent SDK
- Model Context Protocol
- Honcho memory
- Qdrant
Product
- React
- Python
Cloud
- AWS
- Kubernetes
- Agent sandboxing · Tensorlake
Quality
- LLM tracing · Netra
- OpenTelemetry
- VictoriaMetrics
- Grafana
- Audit trail
The right Claude model for every job
Claude is the default model for the Twin’s core work
It drives the Twin’s- Reasoning
- Understanding of requests
- Choice of tools
- Drafting
Claude Opus, Sonnet & Haiku
Matched to each job, from multi-step security workflows to fast checks on every outgoing message.
Agent SDK & MCP
Secure, permission-checked access to connected tools.
Prompt caching
Build a custom prompt caching solution to reduce response times and operating costs.
What an AI twin changes
From security finding to assigned ticket
Quarterly audit preparation
Daily first-line alert triage
Spotting drift in security controls
Inspired by this
success story?
Build your AI product with us.
