> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cork

> Let Neo agents turn Cork Cyber Score drops, failed controls and coverage gaps into PSA tickets, and write each client's quarterly risk review

Cork gives each of your clients a Cork Cyber Score and a cyber warranty, from what your RMM, EDR, MFA, email and backup tools report. Connect it once with a Cork API key, and Neo agents can read and act across your Cork clients.

## What Neo can do with Cork

* Open a PSA ticket when a client's Cork Cyber Score drops, with the areas that lowered it (coverage, compliance, vulnerabilities, claims) and the detail behind the largest one
* Open one ticket per client for its open compliance events (failed controls), each with its evidence and the time its cure period ends, and add a note only for events the ticket does not list yet
* Find coverage gaps: devices one of the client's tools misses (seen by the RMM and not by the EDR or backup tool), and users the identity tool lists that an MFA, security awareness or email security tool misses, or the reverse
* Write a client's quarterly risk review for a QBR: the score trend, the compliance events opened and resolved, the open vulnerabilities and known-exploited CVEs, and the steps that would raise the score most
* Answer questions in a chat with Neo about a client's score, devices, inboxes, compliance events and vulnerabilities
* Read your connected integrations and what each one reports, warranties and invoices, and install a package that fixes a vulnerable app through the client's RMM

## Each ticket stays with its client

One Cork key reaches every client in your account. On a ticket that names a company, Neo sends a call only for the Cork client the ticket's company is mapped to: in the path of a client's own records, or in the `client_uuid` filter of the vulnerability lists and the install history. Calls that cover your whole account (the client list, integrations, warranties, invoices) and software installs run only outside a ticket run, such as from a scheduled agent or a chat with Neo.

## Some changes always ask first

Deleting a connected integration always waits for a technician's approval, whatever the agent's settings, because Cork stops collecting that tool's data. Neo does not connect a new integration, read an integration's stored credentials, or send new credentials to Cork: a technician does those in Cork, so another vendor's credentials never pass through an agent.

## Your clients are mapped to companies

Neo matches your Cork clients to the companies in your PSA and keeps the mapping on the Cork card's **Organization Mapping** tab, refreshed on each PSA metadata sync.

Matching uses the client name: exact, then after stripping a legal-form suffix (Ltd, Inc, LLC). Last comes an AI match for the long tail.

**A name that matches exactly one of your PSA companies, as it is or after stripping a legal-form suffix, or a match you confirm, is handed straight to your agents.** A name two of your PSA companies share, or two clients that match one company, is left to the AI match, and an AI match waits for you on the Organization Mapping tab. Confirm or correct each there.

Anything Neo could not match stays unmapped and visible on the same tab, where you can set the right company by hand. A mapping you set by hand survives every later sync. A scheduled agent opens tickets only for mapped clients, and lists the rest in its report.

See [Cork API](https://docs.neoagent.io/agents/tools/security/cork-api.md) for the permission groups.

## Next steps

> [card] [Connect Cork](https://docs.neoagent.io/integrations/cork/connecting-to-neo.md)
>
> Generate an API key and save it in Neo.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.