---
schema_version: "1"
id: 8074ffbd2e23bcd983f6fe07d833f627c75cb2f7eb75c3b657321f74c1ff6079
title: AI Agent for Security Incident Management
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_agentforce_superagent_securityassistance.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_agentforce_superagent_securityassistance.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a6b9f85b407f8e61274fb94775241bd461c5381e050946a13bb898e7791dfc35
description: Security Assistance is a conversational specialized AI agent that helps employees report security incidents and manage security compliance. Use this agent to report phishing attempts and potential breaches, enroll in mandatory security training, and request exceptions to corporate security policies. This agent supports an organizational security posture.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# AI Agent for Security Incident Management

Security Assistance is a conversational specialized AI agent that helps employees report security incidents and manage security compliance. Use this agent to report phishing attempts and potential breaches, enroll in mandatory security training, and request exceptions to corporate security policies. This agent supports an organizational security posture.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service.</td></tr></tbody></table>

## Service Catalog Items

This specialized agent automatically uses these SCI templates to fulfill your request. You can configure additional service catalog item templates to support similar applications and request types.

- [Report Phishing Email](https://help.salesforce.com/s/articleView?id=service.it_srvcs_rqst_mgmt_sci_sec_rpt_phsh_email.htm&type=5&language=en_US)
- [Report a Security Vulnerability](https://help.salesforce.com/s/articleView?id=service.it_srvcs_rqst_mgmt_sci_sec_rpt_vuln.htm&type=5&language=en_US)
- [Request Security Policy Exception](https://help.salesforce.com/s/articleView?id=service.it_srvcs_rqst_mgmt_sci_sec_scty_plcy_excptn.htm&type=5&language=en_US)
- [Report Device Security Incident](https://help.salesforce.com/s/articleView?id=service.it_srvcs_rqst_mgmt_sci_app_sftwre_device_scrty.htm&type=5&language=en_US)
- [Enroll User in Security Training](https://help.salesforce.com/s/articleView?id=service.it_srvcs_rqst_mgmt_sci_sec_enrl_sec_trnng.htm&type=5&language=en_US)

## Agent Actions

These actions run automatically during your conversation with the specialized agent.

- [Answer Questions with Knowledge](https://help.salesforce.com/s/articleView?id=ai.agent_ref_it_srvcs_answrplcyquestion.htm&type=5&language=en_US)
- [Get Eligible Service Catalog Items](https://help.salesforce.com/s/articleView?id=ai.agent_ref_it_srvcs_getelgblesrvcecatalogitems.htm&type=5&language=en_US)
- [Execute Service Catalog Item Flow](https://help.salesforce.com/s/articleView?id=ai.agent_ref_it_srvcs_executeservicecatalogitemflow.htm&type=5&language=en_US)
- [Get Product Launch Card](https://help.salesforce.com/s/articleView?id=ai.agent_ref_it_srvcs_getproductlaunchcard.htm&type=5&language=en_US)
- [Create Incident For Employee](https://help.salesforce.com/s/articleView?id=ai.agent_ref_it_srvcs_createincidentforemployee.htm&type=5&language=en_US)

![Example](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_example.png)

Example

Reporting a suspected phishing email

Scenario: Employee Anna received a suspicious email claiming to be from IT support asking for her password.

- Anna: I just got a suspicious email asking me to verify my password by clicking a link. It looks like phishing.
- AI Agent: Good catch on identifying that suspicious email. I can help you report it. To confirm before I proceed, can you forward that email to security@company.com and let me know the sender's email address?
- Anna: The sender is it-support-team@companyhelp.net—that's not our real domain, right?
- AI Agent: Correct, that's not our legitimate domain. Security incident INC-009876 has been created to investigate this phishing attempt. The security team will analyze the email and block the sender domain. Never click links or provide credentials in unsolicited emails. Your account has been flagged for extra monitoring for the next 72 hours as a precaution.