Your first day with Averil

Averil is in early access

Averil is an AI security engineer that works in Slack. It connects to the tools you already use, investigates with cited evidence, asks a person to approve each exact action, and closes a case only after it reads back the live state.

During early access, every design partner is onboarded with the founders. Book a time and we set up the connections with you on the call. If you only want a first look, request the free security check.

What to prepare

You need the people who can approve app installs in each tool. One person often covers several.

• A Slack channel for case threads, for example #security.
• The people who may approve standard-risk plans from Slack.
• CODEOWNERS files in your repositories, if you have them. They tell Averil who owns what. You can add them later.

Install the Slack app

1. 1A Slack workspace admin opens the install link we send during onboarding and approves the scopes Slack shows. They are listed in Connect Slack.
2. 2Invite Averil to your case channel with /invite @Averil.
3. 3Tell us who should be able to approve plans from Slack. Everyone else can still read threads and ask questions.

Connect GitHub

1. 1An organization owner installs the Averil GitHub App on your organization. All of its permissions are read-only.
2. 2Choose all repositories or a selection on GitHub's install screen.
3. 3Fixes are a separate, optional app. You can add it later. See Connect GitHub.

The first 24 hours

• Averil reads your GitHub organization and Slack workspace into its context map: repositories, members, CODEOWNERS, the members of teams CODEOWNERS names, and Slack people with their emails. It does this again every 6 hours.
• It posts one introduction in your case channel: what it can see, who owns which repository, the failed checks worth fixing (for example missing branch protection or two-factor), and what it cannot see yet.
• From then on, events from GitHub (and from AWS and the other tools, once connected) become cases when a detection rule fires. Each case gets one thread.
• Otherwise Averil stays quiet. Each person gets at most three unprompted messages a week outside case threads. Critical cases always get through.

Your first morning brief

The night shift reviews repositories that changed, proves problems with a failing test, and sends one short message in the morning with the fixes it opened. A night with nothing proven sends nothing. The night shift is in early access and is turned on with you during onboarding. See Morning brief and night shift.

Separately, once a week Averil posts a check-in in the case channel: what it watched, what happened to cases, what still needs someone, and what it cannot see.