From 65-day remediation to hours: automated security fix PRs

65 Days Is Too Long

The industry average for remediating a security vulnerability is 65 days. That’s not 65 days from when the vulnerability is introduced — it’s 65 days from when it’s detected.

During those 65 days, your codebase is exposed. Your compliance posture is degraded. And your security team is manually triaging, assigning, and tracking fixes through Jira tickets that compete with feature work.

Automated security fix PRs collapse this timeline from months to hours.

How Automated Remediation Works

The process is straightforward:

Step 1: Continuous Scanning

Every push to your repositories triggers a security audit. The scanner checks for:

• Dependency vulnerabilities — outdated packages with known CVEs
• Secret exposure — API keys, tokens, and credentials in code or config files
• Infrastructure misconfigurations — overly permissive IAM policies, open security groups, unencrypted storage
• Code-level issues — SQL injection vectors, XSS vulnerabilities, insecure deserialization

Step 2: AI Analysis and Prioritization

Not every finding is equal. The AI engine evaluates:

• Severity — CVSS score, exploitability, and blast radius
• Context — is this in a public-facing service or an internal tool?
• Dependencies — will fixing this break other things?
• Effort — is this a one-line fix or a refactor?

Critical findings get immediate attention. Low-severity issues get batched.

See the IAN team run on your cloud. We connect to your AWS account via a scoped read-only role, run the Observe-tier agents, and leave you with a concrete audit report — cost waste, security exposure, compliance gaps, and a labor-offset estimate. You keep the findings regardless of next steps. Get a free infrastructure audit →

Step 3: PR Generation

For each actionable finding, the system generates a pull request with:

• The actual code fix (not just a description of what to change)
• A clear explanation of the vulnerability
• Links to the relevant CVE or security advisory
• Test coverage for the fix where applicable

Step 4: Human Review and Merge

The PR goes through your normal review process. Your engineers review the fix, verify the tests pass, and merge. The security finding is resolved.

Total time: hours, not months.

What This Solves

For Security Teams

No more writing remediation tickets that sit in backlog for weeks. The fix is generated and ready for review the same day the vulnerability is found.

For Engineering Teams

Security fixes stop being an interruption. Instead of context-switching to understand a vulnerability and write a fix, engineers review a ready-made PR — like reviewing any other code contribution.

For Compliance

Mean Time to Remediate (MTTR) drops from weeks to hours. That’s not just a metric improvement — it’s the difference between passing and failing your SOC 2 audit.

The Quality Bar

“But can AI write good security fixes?” Fair question. The answer in 2026: yes, for the majority of common vulnerability patterns.

AI-generated fixes excel at:

• Dependency upgrades (the most common remediation action)
• Configuration fixes (tightening IAM policies, closing open ports)
• Secret rotation (replacing hardcoded credentials with vault references)
• Standard code patterns (parameterized queries, output encoding)

For complex architectural vulnerabilities, the AI generates a detailed analysis and recommended approach, but leaves the implementation to your team.

Start Fixing Faster

IAN scans your repositories on every push, generates remediation PRs for critical findings, and tracks your MTTR over time. Connect your repos and see what it finds.

Get a free infrastructure audit → | See pricing →