How to Let AI Remediate a CVE, With Your Approval

What's in the demo

• The Vulnerabilities page on National Vulnerability Database data: 8 known-exploited (CISA KEV) CVEs across 6 devices, and Google Chrome flagged High + KEV on two machines with an approved patch ready
• Open the Breeze AI sidebar, which is scoped to the current organization and uses the same governed tools a technician has
• Ask it in plain English to remediate Chrome on one workstation with the approved patch and confirm what it queued
• Watch the tool calls stream: search devices, check the device's vulnerabilities, check device context
• The approval gate: "Your Approval Is Required" for remediate_vulnerability, with the tool parameters on screen and Verify & Approve or Deny
• The result: three CVEs queued on ACME-WS-014 (CVE-2025-6554, CVE-2025-2783, CVE-2025-5419), one skipped with "no available patch", reported as queued, not installed
• The Audit Trail: each AI tool call, the action intent created and approved, the install-patches command sent to the device, and one remediation entry per CVE

Questions this video answers

Can the Breeze RMM AI assistant install patches without approval?

No. Remediating a vulnerability is a Tier 3 action. The request pauses with the tool's input on screen and waits for a technician to approve or deny it, and nothing is queued until someone approves.

Is every AI action in Breeze RMM audited?

Yes. Each tool call, the approval, the install command sent to the device, and each per-CVE remediation are written to the Audit Trail under the approving user's identity, with timestamps.

Does Breeze RMM flag CISA known-exploited vulnerabilities (KEV)?

Yes. The Vulnerabilities page counts known-exploited CVEs and badges each affected app with KEV. In the demo the AI noted that all three CVEs it queued are on CISA's known-exploited list.

What does the Breeze AI do when no approved patch exists for a CVE?

It skips that CVE and says why. In the demo, CVE-2025-2857 was skipped with the reason "no available patch", left open, and called out as the next thing to check.

Does the AI confirm the vulnerability is fixed?

It reports what it queued, not what it installed. Here it said the patches were queued, the findings stay open until they install, and the device should be rescanned after the install window to confirm they close.