For twenty years, security has ended with a task list: a list of things for someone else to fix.
Actually, with lots of lists. One tool for cloud, another for the software pipeline, another for endpoints, another for the internet-facing estate. Each one finds problems, scores them, and hands over a "fix it" list. Then tickets pile up, the backlog grows, and the same conversation repeats every quarter: we know what's wrong, but we can't fix it fast enough.
Today we're changing where security ends. Mondoo now ends with a fix.
Finding is no longer the hard part
The volume problem isn't going away. The Forum of Incident Response and Security Teams (FIRST) now forecasts around 66,000 new CVEs this year, more than 180 every day.
And AI has changed who can find them. Large language models now find vulnerabilities at speed and scale, including zero-days, flaws nobody knew existed. In DARPA's AI Cyber Challenge, autonomous AI systems analyzed more than 54 million lines of open-source code and found 18 previously unknown vulnerabilities. And they can turn flaws into attacks just as fast and cheaply: an LLM can read a vulnerability report and write a working exploit in minutes for a few dollars. That capability isn't reserved for well-funded research teams anymore; attackers have it too. The window between finding a flaw and exploiting it is shrinking fast. At the same time, developers use LLMs to ship code faster than any team can review it.
So finding vulnerabilities is no longer the hard part. Machines are very good at it, on both sides. AI has already made detection faster. The question security leaders are now asking is, "When does AI make the fix faster?"
That's the question Mondoo is answering today.
What we're launching
Today we're launching agentic remediation: exposure management that fixes. Mondoo finds what's exposed across your code, cloud, on-prem endpoints, AI, and external attack surface, then builds the fix, deploys it through the tools you already run, verifies it worked, and stops it drifting back.
Here's what's new:
- Endpoint remediation delivery via Microsoft Intune and CrowdStrike Falcon. Mondoo delivers fixes through the tools your security and IT teams already trust. No new agents to roll out, no new workflow to learn.
- Code inspection and remediation. Mondoo scans source code for flaws, vulnerable dependencies, and exposed secrets, and delivers fixes where developers work: GitHub pull requests, the IDE, and existing coding agents. Then it checks the revised code to confirm the risk is gone. And it's built to be token-efficient, so scanning a large codebase doesn't come with a large AI bill.
- External attack surface scanning. Mondoo finds your internet-facing hosts and checks them for poor security hygiene, misconfigurations, and vulnerabilities that anyone with an internet connection can exploit. Then it keeps watching, so issues stay closed.
- Enhanced CIS Benchmark remediations. More fixes for more checks, including on systems already in production, tested on real systems and re-scanned to confirm the control passes.
Behind all of this is a team of task-specific agents: one agent scans code, another scans endpoints, others validate risk, assess impact, recommend and build the fix, patch and harden. Each one does one job, and each one explains what it did in plain language your team can review.
And if your team already runs its own AI agents, they can work with Mondoo too. Through the Model Context Protocol (MCP), your agents can talk to Mondoo directly: ask what's exposed, pull the evidence, and trigger the fix inside the workflows you already use.
Autonomous where it's safe. Approval where it matters.
Whenever I talk about autonomous remediation, the first question is always about control. It should be.
No security leader should want an AI to change production databases on its own and risk operational resilience. But most fixes aren't like that. A laptop missing a patch or a misconfigured workstation setting doesn't need a meeting. It needs fixing, now.
So you decide. Mondoo lets you set remediation policies by exposure risk, asset type, and how much automation you're comfortable with. Routine fixes run on their own. Sensitive systems wait for human approval, with the plan, impact, and rollback in front of them before anything changes.
We don't hand AI the keys. We hand you the control. And as your confidence grows, you turn the dial further. That's your path to autonomous remediation.
Fix now. Fix forever.
A fix that comes undone isn't a fix. Configurations drift, new systems get deployed from old images, and someone changes a setting to get something working on a Friday afternoon.
Mondoo uses policy as code to keep systems hardened after the fix. If a configuration drifts, Mondoo fixes it again. Because every finding and every fix is recorded, you have on-demand evidence for compliance and audits, without a week's worth of screenshots or an out-of-date manual spreadsheet.
That's what we mean by Fix Now. Fix Forever.
Run it yourself, or let us run it for you
Not every team wants to operate another platform, and not every team has the people to. So Mondoo is available in two ways. You can run it on our AI-native platform, or have us deliver it as Service as Software through our Agentic Managed Vulnerability Service, where Mondoo's agents and security experts deliver the outcome for you. Many of our partners deliver it to their own customers the same way.
Either way, the measure is the same: outcomes, not findings. Mondoo has already performed more than 5 million remediations for more than 300 customers, and today's launch aims to make that the norm, not the exception.
Come and see it
If you're at it-sa in Nuremberg, 27 to 29 October, come and find us in Hall 7, Stand 7-542. Bring your hardest backlog. We'll show you what it looks like when the list ends with a fix.
