[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEbolxz-oMxaS4nfFIGLcJXgptxAJOIBA9e8E4wGj9z0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"c3c244a5-b704-44ff-8ecd-9cc30cf1daa5","automating-remediation-is-essential-to-closing-the-gap-between-vulnerability-discovery-and-fix","77405141-febc-483a-8c00-5806043294ff","Automating Remediation Is Essential to Closing the Gap Between Vulnerability Discovery and Fix","Organizations increasingly discover vulnerabilities faster than they can remediate them, creating a dangerous backlog of known, unaddressed risks. The core problem is not detection but ownership ambiguity and manual remediation workflows that slow down the fix cycle. When developers cannot quickly identify what code they own, what is vulnerable, and how to fix it, mean-time-to-remediation (MTTR) balloons. Automating remediation workflows — including ownership mapping, guided fix plans, and AI-generated pull requests — directly attacks this bottleneck. Speed of remediation is now a security-critical metric, not just an operational convenience.","**Immediate actions:**\n- Map every cloud asset and deployed component back to its owning team or code author so accountability is unambiguous.\n- Prioritize your vulnerability backlog by exploitability and blast radius, not just severity score, to ensure the highest-risk issues are fixed first.\n\n**Long-term improvements:**\n- Integrate automated remediation tooling (AI-assisted pull requests, guided fix workflows) directly into developer pipelines to reduce friction.\n- Establish and track a formal MTTR target for critical and high vulnerabilities as a key security KPI reviewed at leadership level.\n- Adopt Application Security Posture Management (ASPM) to maintain continuous visibility from code to cloud.\n\n**Detection & process measures:**\n- Instrument CI\u002FCD pipelines with vulnerability gates that block promotion of code with unresolved critical findings.\n- Run regular remediation SLA compliance reports to surface teams or asset classes that consistently miss fix deadlines.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-2: Incident Mitigation","NIS2 Article 21(2)(e)","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"NIST CSF 2.0 RS.MI-2: Incident Mitigation":20,"OWASP A06:2021 Vulnerable and Outdated Components":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"This provision requires security in development and maintenance including vulnerability handling and disclosure, making automated, developer-integrated remediation workflows a direct compliance enabler.","SI-2 requires that organizations identify, report, and correct information system flaws in a timely manner, directly aligning with the need to automate and accelerate remediation workflows described in the article.","This category calls for timely containment and mitigation of identified vulnerabilities, which is what automated remediation tooling and ownership mapping are designed to accelerate.","This risk category highlights the danger of unpatched or vulnerable components in production, reinforcing why rapid, scalable remediation of code-level vulnerabilities is a critical security objective.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities on a defined timeline — exactly the MTTR reduction and automated remediation workflow problem this article addresses.","published","2026-11-12T19:20:38.776691+00:00","2026-11-12T19:20:38.763+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Faspm-ai-era-pt-3-fixing-risk-code-speed","aspm-in-the-ai-era-part-3-fixing-risk-at-the-speed-of-code-85c5a6","ASPM in the AI Era Part 3: Fixing Risk at the Speed of Code",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48],{"slug":34,"name":46,"problem":47},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":49,"name":50,"problem":51},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]