Your First 90 Days With Bitsight AI Mode and MCP

AI is making it easier than ever for threat actors to find and exploit vulnerabilities. And with attack surfaces and supply chains rapidly expanding at the same time, security teams need faster ways to access cyber risk intelligence and act on emerging threats. 

Bitsight AI Mode and MCP — two new Bitsight AI capabilities — help make that possible through conversational AI and agentic workflows.

This 90-day guide shows you how to get started with these new features, while moving beyond just exploring new capabilities to building repeatable workflows that support your  daily security operations. 

New AI capabilities for unlocking cyber risk intelligence

Bitsight AI Mode brings conversational AI directly into the Bitsight platform. Teams can now chat with Bitsight AI and ask questions about vulnerabilities, security findings, vendors, and emerging threats, and then explore and expand on the results with follow-up prompts and questions.

AI Mode also includes preconfigured agentic workflows for common use cases. For example, the Mythos Supply Chain Readiness workflow helps your team assess vendor exposure, while the TPRM ROI and Impact workflow helps you evaluate the performance and business value of your third-party risk management programs.

Bitsight MCP (Model Context Protocol) connects Bitsight intelligence to external AI tools such as ChatGPT, Claude, and Microsoft Copilot. This allows teams to incorporate Bitsight data into their existing workflows, such as digging into security alerts or identifying vendors affected by an emerging vulnerability. 

Days 1–30: Explore and experiment

Your first month with AI Mode and MCP is all about becoming familiar with how they work and how they can help with your everyday tasks. 

With AI Mode, start by dedicating 15 minutes each week to experimenting with prompts. A good first security question could be "which critical security findings should our organization address first, based on vulnerability severity, known threat actor activity, and exposed assets?"

Then ask a follow-up question to deepen the investigation, such as: "How many instances of these findings are present across our organization, and which affected assets should we prioritize?"

You can start experimenting with preconfigured workflows, too. If you want to know about your PHP exposure, try the Assess Emerging Security Events agent. If you’re curious about your own security performance, run the “How is my portfolio performing?” agent.

With MCP, you can start by confirming your access permissions, connecting an approved AI assistant like Claude or ChatGPT, and testing with your everyday tasks for questions. For example, you could ask Claude: "Which vendors in my portfolio experienced a security rating decline over the past 30 days?"

Claude will answer using Bitsight cyber risk intelligence. Compare the responses with your existing Bitsight data, then refine your prompts to get the answers you need. 

By day 30: You'll be comfortable using AI Mode and MCP to explore Bitsight intelligence, and start finding more ways to use it in your role.

Days 31–60: Build repeatable workflows

As you become more familiar with AI Mode and MCP, it’s time to start incorporating them into your everyday workflows. 

Start building on what works by documenting successful prompts you’ve used in AI Mode. You can focus on recurring tasks, such as weekly vulnerability prioritization or monthly vendor risk reviews, and create a repeatable process helping your team complete them more efficiently. 

Next, start bringing AI-generated insights into your meetings and decision-making. AI Mode can, for example, summarize critical findings ahead of a team meeting and help everyone align on the most critical vulnerabilities. 

With MCP, start refining the use cases you tested during your first month. Explore how Bitsight intelligence can integrate with more tools and workflows your team uses, like ticketing systems, vulnerability scanners, and GRC platforms.

For example, your security teams could use an MCP-connected assistant to retrieve Bitsight exposure intelligence while investigating alerts in your SIEM, giving them the context they need to respond quickly and effectively. 

By day 60: You'll have established repeatable workflows, begun to track and measure improvements, and incorporated AI-powered insights into your security decision-making. 

Days 61–90: Expand and automate

Now that you have a clearer understanding of where AI and MCP can add value to your everyday tasks, it’s time to explore more sophisticated — and automated  — workflows. 

Revisit your AI Mode prompts from month 1 to see whether previously identified exposures have been addressed. You could ask, for example, “has exposure to the vulnerabilities we prioritized last month improved, and which findings still require remediation?"

If you’re satisfied with the results, you can start testing more complex prompts or edge cases. 

With MCP, you can explore turning your successful use cases into reusable Bitsight Skills. Skills are reusable instructions that help AI agents complete repeatable tasks using Bitsight intelligence.

You could, for example, create a Skill that guides an agent through its vendor risk assessment process, from retrieving security findings to generating a structured summary for review.

You can also explore custom reporting, command-line integrations, and automated workflows that combine Bitsight intelligence with other authorized systems.

Just make sure to keep the right access controls (and manual oversight) in place, especially for workflows that trigger actions or modify your data. 

By day 90: You'll be familiar with creating reusable Skills for automated workflows, and ready to incorporate Bitsight intelligence into your long-term security decisions. 

Beyond the first 90 days

Adopting AI doesn't mean transforming security operations overnight. By taking time to explore AI Mode and MCP in your first month and experimenting with real-world use cases, you can turn these tools into valuable parts of your everyday workflows. 

And the learning doesn’t stop after three months. As you gain confidence, keep refining your prompts and exploring new ways to put Bitsight Cyber Risk Intelligence to work. You’ll see measurable improvements and new ways to help your team stay ahead of emerging threats. 

Want to see these capabilities in action? Check out our on-demand webinar, Crash Course on Bitsight MCP and Agentic Workflows: A 90-Day Guide or request a demo.