Vulnerability remediation
Four questions before anyone fixes it.
An operator reads each scanner finding and the code behind it, answers four questions with the evidence, and drafts the fix as a pull request. A person approves it.
- ISO 27001
- GDPR
- Every run auditable
CVE-2022-42889 in commons-text 1.9
- Is the vulnerable call used?Yes. TemplateRenderer.java line 41 calls StringSubstitutor.createInterpolator().
- Does outside input reach it?Yes. Campaign templates come from the email-campaign API.
- Is it in what you ship?Yes. It is in the production build, not a test dependency.
- Who owns it?Notifications team (CODEOWNERS).
Bump commons-text 1.9 → 1.10.0 in notification-service
pom.xml− <version>1.9</version>+ <version>1.10.0</version>Jira SEC-412 for the notifications team, linked to the PR. Your CI runs on the pull request like on any other.
Enterprises running operators on Alomana
- 60–96%of scanner findings ruled out as false positives
- Weeks to hoursfrom finding to a fix ready to merge
- 80–90%less manual triage and remediation effort
What the operator does with each finding
Scanners find plenty. The work is deciding what matters here and getting it fixed.
- The export
- Reads the findings your scanners already produce
- The code
- Reads the code and configuration behind each finding
- Does it matter here
- Checks use, outside input and what you ship, and shows the evidence
- Duplicates
- Groups the same flaw reported by several tools
- The fix
- Drafts the pull request, the Jira ticket for the owner or the closing note
- The record
- Logs what it read, what it decided and who approved it
How the operator works a finding
1
Connect
Scanner exports, your code host, Jira, Slack.
2
Read the code
It checks whether the finding matters here.
3
Approve the fix
You say yes. It opens the PR and logs it.
The fix waits for a person's yes.
- Pull requests and tickets wait for a person's yes
- A declined action is not retried
- Every run logged: input, output, tools, user
Measured on
- Mean time to remediate
- Open critical and high findings
- Findings closed with evidence
- Engineer hours per fix
Works with
- Jira
- Slack
- Confluence
- SharePoint
- Google Drive
- Your code host via MCP
- Your scanners via MCP or export
Trusted for
- ISO 27001
- GDPR
- Never trains on your data
- Single-tenant for enterprise
A custom operator typically goes live in up to 4 weeks.
Questions
What is an AI remediation operator?
An autonomous agent that works your vulnerability backlog. It reads each scanner finding and the code behind it, says whether the finding matters in your codebase with the evidence, and drafts the fix for a person to approve: a pull request, a Jira ticket for the owner or a note closing it.
Does it replace our scanners?
No. It works on the findings your scanners already produce: an export in SARIF, JSON or CSV, or the scanner itself through a remote MCP server. Your tools keep finding; the operator works what they found.
Does it change our code on its own?
Opening a pull request, filing a ticket or posting a message waits for a person's yes: sends and writes through Alomana's connectors, and MCP tools that declare a write, as GitHub's MCP server does for pull requests. A declined action is not retried, and every run is logged.
Which systems does it connect to?
Alomana has 20+ connectors, including Jira, Slack, Confluence, SharePoint and Google Drive, activated per deployment. Systems outside the library, such as your code host or your scanners, connect through a remote MCP server.
How long does it take to deploy?
A custom remediation operator typically goes live in up to 4 weeks, including validation and integration.
Is our code private?
Alomana is ISO 27001 certified and GDPR-compliant, and your data is never used to train AI models. Enterprise deployments run single-tenant, in a dedicated instance.
Bring one scanner export.
Talk it over with sales: what the operator needs from your systems, and how it goes live.
Alomana is a secure enterprise AI platform where autonomous agents, called operators, run business processes end to end. Every run is fully auditable.