[Investigation] Deep-dive investigation on any security topic — CVEs, threat actors, assets, endpoint events, vulnerability intelligence. @slow

USE WHEN: "tell me about CVE-2024-3400", "are we exposed to Lazarus Group?", "investigate this IP", "what ransomware vulns exist?", "deep dive on Log4Shell", "what's happening on 10.0.0.1?"

[Risk Assessment] Cross-domain risk assessment — VMs, cloud, containers, web apps, certificates, assets. @slow

USE WHEN: "what's our risk?", "show me cloud risk in AWS", "top risky assets", "container vulnerabilities", "expiring certificates", "EOL systems", "risk by business unit", "how's our security posture?"

[Compliance] Compliance posture assessment — framework pass/fail rates, failing controls, risk acceptances. @slow

USE WHEN: "are we PCI compliant?", "compliance gaps", "show failing controls", "risk acceptances expiring", "HIPAA posture", "CIS benchmark results", "what frameworks do we have?"

[Remediation] Remediation planning — patch priorities, deployment status, mitigation coverage, program gaps. @slow

USE WHEN: "what should we patch?", "outstanding patches", "patch deployment status", "mitigation coverage", "is there a mitigation for CVE-X?", "what's missing from our security program?", "how do we reduce risk?"

[Overview] Security briefing — daily/weekly/monthly summary with scanner health, findings, and risk trends. @slow when quick=False

USE WHEN: "morning briefing", "what happened this week?", "security overview", "any new critical vulns?", "scanner status", "what needs attention today?"

[Reporting] Unified report operations — list, templates, generate, status, download, delete.

[Admin] Show cache stats or clear all caches.

[Cloud] AWS Organization connectors — list and health status for multi-account AWS setups.

USE WHEN: "show AWS org connectors", "AWS Organizations status", "multi-account cloud connector health", "which AWS accounts are connected", "AWS org sync status"