Security remediation under your authority.

Choose exactly what is authorised

A customer can authorise the complete recommended bundle, selected remediation, individual findings or no changes. Each approval needs to be tied to identified targets and actions. Approval of a report is not an unrestricted grant to alter unrelated systems.

The full specification includes closing unnecessary ports, modifying firewall rules, disabling unsafe services, correcting permissions, patching software, removing insecure defaults and strengthening SSH or TLS configuration. Credential rotation, database hardening, container restrictions, logging improvements and isolation are also specified where supported and authorised.

Before a material change, establish whether it is safe to proceed

The pre-change workflow establishes current state, determines dependencies and possible impact, prepares rollback, preserves connectivity and records the authorised action. It must account for administrator access and production workloads. If the current state no longer matches the approved plan, the action should return for reassessment.

A firewall change illustrates the requirement. Record the existing rules and management path, confirm the intended new access, arrange recovery and check the affected services. Removing an exposure while locking out the operator is not a verified successful outcome.

• Define the action, target, authority and expected postcondition.
• Identify dependencies, downtime and recovery requirements.
• Preserve an audit record of the approved and attempted operation.
• Reassess when evidence, scope or conditions change.

Attempted is different from verified fixed

After remediation, AI Defence is designed to retest the vulnerability, exposure, service health, network accessibility, application health and security configuration relevant to the change. The result should preserve the evidence and distinguish success, failure and an inconclusive check.

An action that runs successfully but leaves the vulnerable process active remains unresolved. A security fix that breaks application health requires investigation and recovery. Unsupported actions must remain recommendations for an authorised operator, rather than being presented as automated capabilities.