Hours back every month: how security teams use Leena AI Forge to move faster

Employees report suspicious emails every day. Each one has to be checked before an analyst can close it.

A security team at a global enterprise built an AI Colleague on Leena AI to do the first check. Every reported email becomes a ServiceNow ticket. The AI Colleague picks it up, pulls out the sender, links and attachments, checks them against VirusTotal and URLScan, and writes a summary and a proposed verdict back to the ticket. An analyst makes the final call.

It handles about 19 reported emails a day, around 1,100 every two months.

Going live was the start. Keeping the AI Colleague accurate is the real work, because everything around it keeps changing.

• One fix can break another. The procedure is long, and every edit has to keep earlier rules intact.
• Connected systems change. Before go-live, the step that fetched emails from ServiceNow couldn’t read attachments and had to be rebuilt.
• Environments drift. Staging and production ended up with slightly different tool names, so what worked in one failed in the other.
• Models change. The same instructions can behave differently on a new AI model.

Every change starts the same loop: spot a wrong verdict or a failed run, find out why, fix it, test it, publish it.

The slowest step is finding out why. The builder traces the run step by step and reads what every tool returned. That takes about 25 minutes per issue. Everything else waits until it’s done.

Forge is built into the Leena AI platform. The builder asks in plain English: “Why did this run give the wrong verdict?”

Forge reads what the builder would otherwise dig through by hand: the procedure, the run history and every tool response. It explains the cause in plain language, proposes the fix, and makes the change once the builder approves.

On this team’s phishing AI Colleague, an issue that took about 25 minutes to trace by hand took Forge 15 seconds. Same cause. Same fix.

One issue saves about 25 minutes. The value shows up over a month.

• By hand: a builder chasing 20 issues a month spends about 8 hours tracing runs
• With Forge: about 5 minutes
• Across five AI Colleagues: roughly 40 hours, a full work week back every month

That time goes into moving faster: tuning verdicts, adding sources, shipping the next use case.

It also decides what survives. An automation that’s cheap to maintain stays live. One that isn’t eventually gets switched off.

See Forge do it live.

In a 30-minute demo, watch Forge take a real HR or IT use case from a plain-language description to a built, tested automation. Book a demo

Read the launch post: Introducing Leena Forge

Book a demo