How do findings get fixed instead of just counted?
Remediation guidance and an AI fix prompt on every finding, plus fix branches for source code.
Every finding comes with fix guidance and an AI fix prompt that drafts the CLI command, Terraform change or console steps; for SAST findings in source code, AI Code Fix pushes a fix branch to your repository. Each fix is explained in language an engineer will act on.
- posture rules
- 9,853
- cloud providers
- 7
- cloud services
- 549
- compliance frameworks
- 78
Security tools are very good at producing findings and very bad at producing outcomes.
The queue grows, the dashboard turns red, and the engineering team receives a ticket saying 'S3 bucket policy is overly permissive' with a link back to the tool. Nobody disagrees that it should be fixed. It does not get fixed, because turning that sentence into a correct change against a specific bucket in a specific account is the actual work, and the tool left it undone.
How Remediation & AI Fix works
- 01
Every posture rule carries written remediation guidance, so each finding arrives with its own steps to fix it.
- 02
Every finding also carries an AI fix prompt that names the resource and your cloud's tooling; paste it into an assistant to draft the CLI command, Terraform change or console steps, then review before applying.
- 03
SAST findings in source code are handled by AI Code Fix, which rewrites the affected file and pushes the change to a separate fix branch in the repository the finding came from, for your team to review and merge.
- 04
Vulnerable dependencies show the fixed version from the advisory where one exists, so the upgrade to make is named rather than left for someone to research.
- 05
Attack paths open as a step-by-step story, with each hop's MITRE ATT&CK technique and remediation step, so prioritisation conversations are about impact rather than severity labels.
What you see in the console
- Remediation guidance per rule, plus an AI fix prompt for CLI, Terraform or console steps
- Fix branches for SAST findings in source code, for your team to review and merge
- Fixed versions from the advisory for vulnerable dependencies
- Attack-path stories with a remediation step on each hop
- Suppression for one finding or a whole rule, with reason, author and expiry
- Tickets in Jira or ServiceNow; alerts to Slack, PagerDuty, email or webhook
- Verification on the next scan that the fix landed
Remediation & AI Fix in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
Questions we get a lot
See Remediation & AI Fix on your own cloud
Book a 30-minute demo. We walk through it on sample data, or on one of your accounts if you want to connect it.