What data drives mobilization?
The assets and exposures from the earlier steps, with their unified context.
-
Unified context
Identifies owners and conditions for triggering mobilization.
-
Queries
Trigger workflows, ticket binding, and other remediation processes, and later validate if a remediation was in fact implemented.
-
Dashboards
Present data to manage the mobilization, ownership and the information for tracking, reporting, and carrying over conversations with other stakeholders in your company.
Read the full section
In the previous CTEM steps, Axonius collected accurate data across your assets and exposures with unified security, asset, and business context. This data is used as the basis for assigning owners, triggering, managing, and validating the mobilization across your attack surface.
Axonius supports mobilization by identifying owners, triggering mobilizations through automation and tickets, tracking the remediation process, and validating if a remediation is effective.
What are enforcement actions?
Enforcement Actions are API-based integrations provided by Axonius to perform tasks in third-party systems.
Read the full section
In the context of Mobilization, Enforcement Actions automatically remediate third-party systems — through actions such as remote patch a workstation, deprovision a user, quarantine/isolate a laptop, or turn off a virtual machine — or notify or mobilize teams to manually remediate exposures through notifications and tickets.
As of March 2025, Axonius supports 480+ actions. Actions can be triggered in three ways: through enforcements, workflows, or ticket binding.
How do workflows and enforcements trigger mobilization?
By using queries or other triggers, you define when the mobilization will happen and what actions should be performed.
-
Enforcements
Enforcements provide a simple and easy way to mobilize. They are great for simple actions and can be triggered not only automatically, but also directly from the Axonius interface when a specific asset or exposure requires immediate mobilization.
-
Workflows
Workflows expand enforcements with no-code, allowing you to add your own logic to the mobilization. They work well when you need to change action based on logic — i.e. deploy an EPP agent only if the asset can receive remote commands via SCCM/MECM. Otherwise, open a ticket for manual remediation.
Read the full section
Workflows can also be triggered by events external to Axonius, such as when a Slack message is received, an employment status change in HR, or a critical event is triggered by other solutions in your stack.
How does ticket binding mobilize other teams?
Case management and ticket binding trigger work in other teams’ ticket systems of choice whenever a query matches.
Read the full section
The query uses your defined policy to mobilize the right team and ticket system — i.e. SRE team and PagerDuty, Internal IT and ServiceNow, Engineering and Jira — decide what ticket operation will be executed (create a new ticket or update an existing one), and create a case in Axonius to keep track of the ticket execution against your security MTTR and SLAs.
As tickets progress, Axonius keeps track of what assets and exposures are fixed and the status of the associated ticket across different teams.
Through ticket adapters and dashboards, Axonius can continuously track the ticket progress and highlight tickets and cases overdue across different teams.
What happens as the attack surface changes?
The queries that trigger mobilization are re-evaluated as exposures come and go.
Three benefits follow. Pick a case:
A new asset matches
- A query identifies a new asset or exposure.
- The workflow or ticket binding behind it runs again, unchanged.
- Write once, always enforce. Your mobilization is triggered whenever new assets or exposures are identified by a query.
Ticket closed, issue stays
- A ticket is opened with the owning team.
- The ticket is closed, but the next discovery cycle still finds the issue.
- Closed loop remediation. Mobilizations are re-triggered if a ticket is closed but the issue is not solved.
The risk comes back
- The exposure is remediated and the query stops matching.
- Later, the risk or the exposure is reintroduced to the attack surface.
- Re-enforce as risk is reintroduced. Mobilizations are re-triggered whenever asset risk or exposures are reintroduced to your attack surface.
Read the full section
As highlighted in previous steps, Axonius continuously reassesses your Scope, Discovery, and Prioritization, as your attack surface changes and exposures are introduced or remediated. The Axonius findings are constantly reevaluated, updating the queries used to trigger mobilizations across all the features highlighted in this step. That provides many benefits including: write once, always enforce; re-enforce as risk is reintroduced; and closed loop remediation.
From pages 23 to 28 of the PDF. Download the PDF