Uravation launches six-hour corporate training on AI agent vulnerability response
October 29, 2026 · 3 min read
Uravation has begun offering a six-hour corporate training program focused on managing software vulnerability responses using AI agents. The course is designed for information systems departments, web administrators, and development teams. It uses the October 21, 2026, PHP security release as its primary case study. Participants practice a full day of response procedures on a fictional company's website portfolio. The training explicitly excludes vulnerability scanning, penetration testing, 24-hour monitoring, and forensic investigation services.
The core methodology divides tasks between AI agents and human operators. AI agents handle reading official security advisories, identifying affected software versions, drafting response procedures, and verifying updates. Human operators retain the final authority to approve changes to production environments and to send communications to business partners. The training aims to establish these division-of-labor boundaries within a company before an emergency occurs.
The six-hour curriculum follows a specific timeline. The first thirty minutes cover a retrospective of the October 21 response, from the October 20 pre-alert to the final verification. The next hour focuses on preparing AI agents, specifically setting permissions for Claude Code and Codex, configuring systems to avoid sharing sensitive information, and enabling operation logs. Subsequent hours are dedicated to reading official notices from developers and the Information-Technology Promotion Agency, inventorying affected sites and servers, drafting procedures for approval, and creating templates for verification records and partner communications. The session concludes with a presentation of the participants' own inventory and division-of-labor tables.
Uravation enforces six specific rules for delegating tasks to AI agents. Humans must approve the target, content, and rollback plan before any production change. AI agents are granted read-only permissions for summarizing advisories and creating lists. Passwords and API keys are never written into prompts or logs. Instructions found within web pages, logs, or emails are treated as data, not commands. AI agents must attach concrete evidence, such as updated version numbers or transmission records, to any report of completion. Finally, AI agents draft partner communications, but humans must verify the full text before sending.
The training is available online or as an on-site visit, with a maximum of ten participants per company. Each participant requires a personal computer and an account for either Claude Code or Codex. Uravation issues a certificate of completion to each attendee, which is not a professional qualification or certification. The company states that it uses AI agents daily for its own site and server operations, applying the PHP update to its managed servers approximately one hour after the release was published.
Uravation is an AI company based in Bunkyo, Tokyo, specializing in generative AI training, consulting, and development. The company does not provide vulnerability diagnosis, intrusion testing, continuous monitoring, or incident recovery services. It recommends consulting specialized vendors for those specific needs. The training is positioned as an operational exercise for running response workflows, not as a program to train security experts.