Product · Automated remediation
Fix issues the moment they land
Security tools are good at finding problems and bad at closing them. Findings pile up faster than teams can fix them, and blanket auto-fixing is too risky to trust. RingZero's answer is configurable, human-in-the-loop remediation: the agent proposes — and can apply — fixes, but your org decides how much autonomy it gets, per severity, per project, and per oversight mode. The right issues get fixed fast; risky changes still get a human's eyes.
Three oversight modes, one dial
- Auto-apply — the agent applies the fix and verifies it. Still gated by your severity threshold; every apply is logged with its rationale.
- Approve-each — the agent prepares the fix; a human approves or rejects each one. Nothing changes without an explicit approval event.
- Watch-only — the agent notifies and never modifies code. For the services where "automated" should mean "informed", not "changed".
A severity threshold decides what the automation acts on at all — findings below it are recorded and skipped, not silently dropped — and prioritized projects jump the queue. Per-project overrides mean your payments service can run watch-only while everything else auto-applies low-risk fixes.
From finding to closed
Findings arrive from AI penetration tests, supply chain scans, and MCP config scans, and enter one pipeline: prioritize, propose a fix with AI context, then route by mode. Applied fixes are verified — built and tested, reverted and flagged if verification fails — and closing a finding updates your security score and severity counts live, so the feedback loop is visible.
Automation you can audit
Every step emits an audit entry: actor (agent or human), action, finding, fix, rationale,
timestamp. When an auditor asks "who changed this and why", the answer is a record, not a
reconstruction. The same approval pipeline handles code fixes and config fixes (like a
.mcp.json diff from an MCP finding), so there is one trail to review.
Watch the triage feed route findings live in the interactive demo, or see the approve-a-diff flow in the security workspace demo.
Frequently asked questions
Will RingZero change my code without asking?
Only if you tell it to. The default posture is yours to set: auto-apply for low-risk fixes, approve-each for anything that needs human eyes, or watch-only for services where nothing should ever change automatically. Modes and severity thresholds can be overridden per project.
What does a proposed fix look like?
A before/after code diff with the finding’s summary, location, and severity, plus an expandable rationale explaining why the agent suggests this change. You approve or request changes from the same panel — nothing lands without an explicit approval event unless the project is in auto-apply mode.
What happens after a fix is applied?
The fix is verified — built and tested — and reverted and flagged if verification fails. A successful fix closes the finding, decrements the open severity counts, and updates your org security score, so remediation progress is visible immediately.
Is there an audit trail?
Every action — proposed, approved, auto-applied, watched, skipped — is logged with the actor (agent or human), the finding, the fix, the rationale, and the timestamp. Remediation is fully reviewable after the fact.
Can I limit automation to certain severities or projects?
Yes. A minimum-severity threshold decides what the automation acts on (everything below is recorded but skipped), prioritized projects get triaged first, and per-project overrides let a sensitive service run watch-only while the rest of the org auto-applies low-risk fixes.