Marcus AI Assistant

Marcus is Guard's AI assistant. In addition to its existing capabilities, Marcus can answer questions about how Guard works by searching a dedicated index of official product documentation and returning sourced, grounded answers.

What Marcus can help with

Marcus is suitable for questions about:

• Guard features and how they work
• Configuration options and workflows
• Platform modules and their capabilities

For questions outside the scope of product documentation — such as account-specific issues or custom engagement details — open a support ticket through the standard support channel.

How to ask Marcus a product question

1. Open Guard and select the Marcus assistant from the navigation.
2. Type your question in natural language. For example:
   • "How do I configure SCIM provisioning?"
   • "What does the Attack Surface Management module monitor?"
   • "How are vulnerabilities prioritized in Guard?"
3. Marcus searches the product documentation index and returns an answer grounded in the relevant documentation.

There is no special syntax or mode required. Marcus automatically queries the documentation index when a question relates to Guard product functionality.

How answers are grounded

Marcus retrieves answers from a vectorized index built from Guard's official product documentation. This index is separate from Praetorian's internal offensive knowledge base, so responses reflect only client-facing product content. If Marcus cannot find a relevant answer in the documentation, it will indicate that rather than speculate.

Performance on large workflows

Sessions that involve a high number of sub-agents or workflow steps — for example, workflows with roughly 300 or more steps or 50 or more sub-agents — previously caused the AI Assistant view to degrade as polling and update activity scaled with the size of the workflow tree. Guard now applies the following behaviors to keep the interface responsive regardless of workflow complexity:

• Bounded conversation polling — Active polling is restricted to the open chat and any pending human-in-the-loop rows, rather than every node in the workflow tree. Idle conversations are not polled.
• Scoped WebSocket invalidation — When a WebSocket event signals that a conversation has changed, only the specific parent probe affected is invalidated and refreshed. The rest of the conversation graph is not re-fetched.
• CORS preflight stability — OPTIONS requests are excluded from API rate limiting, which prevents CORS preflight failures from interfering with authentication checks during busy or high-traffic sessions.

These changes are applied automatically. No configuration is required.

Limitations

• Marcus answers questions based on indexed product documentation. It does not have access to your organization's specific configuration, findings, or asset data when answering general product questions.
• Answers reflect the documentation at the time of the most recent index update. If you believe a doc-based answer is outdated, contact support.
• Marcus is not a substitute for support when troubleshooting account-specific issues or unexpected platform behavior.