Notifications
Clear all
Topic starter
16/09/2026 9:21 am
TL;DR: AI can speed up simple answers, but it also risks repeating outdated guidance when product knowledge, context, or judgement is missing, according to PassBolt. The larger lesson is that support and identity operations still depend on human verification, escalation, and recovery discipline, not just automation.
NHIMG editorial — based on content published by PassBolt: Inside Passbolt Support
Questions worth separating out
Q: How should security teams use AI in application security without weakening human judgment?
A: Security teams should use AI to augment, not replace, experienced AppSec judgment.
Q: What breaks when recovery credentials are stored in the system they are meant to repair?
A: Recovery becomes circular.
Q: How do you know a support process is actually working for identity-adjacent issues?
A: It works when tickets are reproducible, escalation is fast, and recovery does not depend on guesswork.
Practitioner guidance
- Use AI for triage, not final resolution. Let automation summarise common issues and draft responses, but require a human to validate anything involving access recovery, security impact, or version-specific behaviour.
- Standardise ticket intake before escalation. Require version, setup, logs, and prior troubleshooting steps in every support request so engineers can reproduce the issue instead of guessing.
- Test restore paths under real outage conditions. Validate that backups, replica restores, and recovery keys work when the primary system is unavailable, not just when the environment is healthy.
What's in the full article
PassBolt's full article covers the operational detail this post intentionally leaves for the source:
- How the support team reproduces tickets internally before replying to customers
- The mechanics of working through PGP messages, organisation recovery keys, and Docker-based restores
- How support decides when to pull in Product, Engineering, or Security
- What customers can include in a ticket to speed resolution and reduce follow-up
👉 Read PassBolt's support team interview on AI, recovery, and troubleshooting →
AI in support workflows: what does it change for access and trust?
Explore further
16/09/2026 9:21 am
AI support creates a judgement gap, not just an efficiency gain. The article shows that simple questions can be handled by automation, but the hard cases still depend on code reading, reproduction, and product context. That matters because support work often sits close to credentials, recovery, and exception handling, where a wrong answer is operationally expensive. The practitioner conclusion is that AI should assist triage, not own resolution.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, which shows that confidence and operational discipline are not the same thing.
A question worth separating out:
Q: Should organisations prioritise documentation or automation first for support resilience?
A: Prioritise documentation and restore clarity first. Automation helps only when the underlying process is well understood, current, and evidence-driven. If runbooks are outdated or incomplete, AI and workflow automation will simply accelerate the wrong answer.
👉 Read our full editorial: Passbolt support shows why AI cannot replace product judgement
