AI JedAI and XForce GPT, the two AI engines inside DigitalXForce
AI JedAI and XForce GPT are the two proprietary AI engines inside DigitalXForce: AI JedAI analyzes, and XForce GPT writes. AI JedAI reasons over control evidence and live telemetry, scores and prioritizes risk, and recommends remediation. XForce GPT turns that analysis into the risk narratives and board reports people read, and it also drafts policies and runs the embedded assistant. Together the two engines are module 14 of the 15 modules of the TRiSCM™ (Trust, Risk, Security and Compliance Management) platform. They are also available as a feature in their own right.
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Inside the platform, AI JedAI analyzes that evidence, and XForce GPT writes the narratives and board reports that explain it.
What does AI JedAI do?
AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements. Its reasoning decides whether a control passes, against the criteria people set.
In X-ROC, the XForce Risk Operations Center, AI JedAI analyzes incoming events, groups related ones and recommends the order of work. When a supplier reports a breach, AI JedAI maps it to the services and data that depend on that supplier. It also reads a supplier’s SOC 2 and ISO reports and maps what they say to the organization’s own controls.
What does XForce GPT do?
XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant. It also powers compliance reporting.
XForce GPT writes the executive narrative from the same data the risk team works with. It says what changed, what the financial exposure is and what was done. In AI-Powered Policy and Compliance Management, XForce GPT drafts the policies and AI JedAI reviews them against the frameworks the organization reports on. The policy templates are built on industry standards such as NIST CSF and NIST 800-53.
How does a board report trace back to the evidence?
XForce GPT writes the board-ready narrative from AI JedAI’s analysis. Each input behind that analysis can be traced to the tool it came from, the control it belongs to and the date it was read.
Suppose a board member asks where a number came from. The CISO follows it back from the sentence in the report to AI JedAI’s analysis. From there the trail leads to the evidence and the date it was read. The board cyber risk reporting page shows the questions a board asks and the record that answers each one.
Who checks what the AI engines produce?
An analyst reviews AI output, both AI JedAI’s conclusions and XForce GPT’s drafts, before anyone relies on it, and every conclusion links back to the evidence it used. People decide the scope, the owners, the risk appetite and what counts as a pass, and they approve every change to a system.
AI JedAI recommends the remediation, and the team that owns the system makes the fix. X-ROC, where that work is tracked to closure, never changes a customer’s systems on its own. The control is tested again when the fix is marked done, and the finding closes only when the retest passes. The article How Automated Control Testing Decides Whether a Control Still Works explains that retest.
Where do AI JedAI and XForce GPT work across DigitalXForce?
The two engines share one data layer with the other DigitalXForce modules, so the same analysis shows up in several places.
- In the AI-Powered Enterprise Risk Management (ERM) module, AI JedAI scores and prioritizes each risk and recommends mitigation. XForce GPT writes the plans and the board metrics.
- In the AI-Powered Third-Party Risk Management (TPRM) module, AI JedAI maps a supplier’s SOC 2 and ISO reports to the organization’s controls. An analyst reviews that reading before anyone relies on it.
- In X-ROC, XForce GPT writes the board-ready risk reports from AI JedAI’s analysis.
- The Enterprise Security Risk and Posture Management (ESRPM) module runs configuration checks through 250+ technology integrations. The ESRPM page describes AI analysis that identifies and prioritizes security risks.
- The KPI and KRI Management module and the Digital Trust Portal present the indicators and the posture view that the board reports describe.
How do the two engines quantify cyber risk?
Cyber risk quantification (CRQ) quantifies a cyber risk in dollars, giving the financial loss the organization would face if the risk materializes. Both engines take part in this work.
AI JedAI quantifies a cyber risk from the likelihood of an incident, given how the security controls are applied, and from the impact that incident would have. XForce GPT works from the NIST and ISO risk management frameworks to automate quantification and prioritization. DigitalXForce quantifies cyber risk with its own model, built on industry best practices and the data the platform collects.
Questions to ask any vendor about AI in a risk platform
Every vendor that puts AI into a risk platform, DigitalXForce included, should be able to answer these questions in a demo. The answers show whether a person can check what the AI concluded.
- Ask which part of the AI analyzes the evidence and which part writes the report.
- Ask whether each sentence in a board report links back to the evidence and the date it was read.
- Ask who reviews AI output before the board or an auditor relies on it.
- Ask whether the AI can change a production system on its own, or whether the owning team makes every fix.
- Ask what happens after a fix is marked done, and whether the control is tested again before the finding closes.
- Ask which frameworks the policy drafts are built on.
How can a team see AI JedAI and XForce GPT on its own data?
The standard DigitalXForce proof of value runs for 4 weeks on the customer’s own systems and frameworks. Connectors are configured in week 1. The first assessments run in week 3. In week 4 the customer’s team reviews them with DigitalXForce, along with AI JedAI’s analysis of its own data. The 4-week proof of value page describes each week.
Questions about AI JedAI and XForce GPT
What are AI JedAI and XForce GPT?
AI JedAI and XForce GPT are the two proprietary AI engines inside DigitalXForce: AI JedAI analyzes, and XForce GPT writes. AI JedAI scores and prioritizes risk from control evidence and live telemetry. XForce GPT writes the risk narratives and board reports, drafts policies and runs the embedded assistant.
What is the difference between AI JedAI and XForce GPT?
AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements. XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant.
Who writes the board narrative?
XForce GPT writes the board-ready narrative and reports from AI JedAI’s analysis. An analyst reviews the draft before anyone relies on it. Each input can be traced to the tool it came from, the control it belongs to and the date it was read.
Does a person review what the AI engines produce?
An analyst reviews AI output, both AI JedAI’s conclusions and XForce GPT’s drafts, before anyone relies on it, and every conclusion links back to the evidence it used. People decide the scope, the owners, the risk appetite and what counts as a pass, and they approve every change to a system.
Can AI JedAI change our systems?
AI JedAI recommends remediation mapped to framework requirements, and the team that owns the system makes the fix. X-ROC never changes a customer’s systems on its own. The control is tested again when the fix is marked done, and the finding closes only when the retest passes.
Which engine writes policies?
XForce GPT drafts the policies, standards and plans, and AI JedAI reviews them against the frameworks the organization reports on. XForce GPT works from predefined templates built on industry standards such as NIST CSF and NIST 800-53.
Which engine quantifies cyber risk?
Cyber risk quantification (CRQ) quantifies a cyber risk in dollars, giving the financial loss the organization would face if the risk materializes. Both engines take part in this work. AI JedAI quantifies risk from likelihood and impact. XForce GPT works from the NIST and ISO risk management frameworks to automate quantification and prioritization.
Are AI JedAI and XForce GPT available on their own?
Yes, AI JedAI and XForce GPT are available as a feature in their own right. They are also module 14 of the 15 DigitalXForce modules. They test controls, analyze and generate policies, produce compliance reports, quantify risk and run the embedded assistant.
Related pages
The article How AI JedAI and XForce GPT Enable Automation of DigitalXForce Digital Trust Solutions introduces both engines and the DigitalXForce solutions they support. The glossary entry for AI JedAI and XForce GPT defines the module. The glossary also has its own entries for AI JedAI and XForce GPT.
- The Continuous Control Assurance page explains how a control result is validated.
- The X-ROC page shows how an alert is triaged, escalated and closed.
- The page Board cyber risk reporting built on validated control evidence pairs board questions with the record that answers each one.
- The Operationalize TRiSCM page sets out what people decide and what the platform does.
- The article Will AI Replace Cybersecurity Teams? What the Evidence Says covers where AI prepares the work and where people make the call.
Sources
- The article How AI JedAI and XForce GPT Enable Automation of DigitalXForce Digital Trust Solutions describes the two engines. The DigitalXForce glossary and FAQ page describe them too. All three were read on October 25, 2026.
- DigitalXForce describes the engines’ work in X-ROC, ERM, TPRM, ESRPM and Policy and Compliance Management on the product pages for those modules, read on October 25, 2026.
See both engines on your own systems.
A 30 minute walkthrough on your own frameworks shows AI JedAI’s analysis and the XForce GPT draft that explains it, side by side. The DigitalXForce team answers every demo request within 1 business day.
