What's Happening?
Tamnoon, a cloud security company co-founded by Marina Segal, has launched a new cloud remediation engine designed to intelligently refuse unsafe changes in cloud environments. Unlike conventional automation tools that primarily focus on speed, Tamnoon's
engine prioritizes restraint, learning when not to act. The company's data indicates that over half of all detected cloud security findings remain unaddressed, with critical issues taking an average of 150 days to resolve. Tamnoon's engine analyzes various factors, including resource dependencies, ownership, recent changes, and traffic patterns, to determine the safety of a proposed remediation. If a change is deemed unsafe or its impact is unclear, the engine will decline it, providing a detailed explanation and evidence for its decision. This approach aims to prevent outages and ensure that only verified safe changes are implemented.
Why It's Important?
This development addresses a critical challenge in cloud security: the fear of automated remediation causing unintended disruptions. Many organizations are hesitant to fully automate security fixes due to the potential for outages, which can be more damaging than the security vulnerability itself. Tamnoon's 'refusal' capability builds trust in automation by demonstrating a machine's ability to exercise judgment and prioritize operational stability. This could significantly accelerate the remediation of cloud security issues, reducing the average time critical findings remain open from months to a more manageable timeframe. By providing clear evidence for declined changes, the engine empowers security teams to make informed decisions and reduces the burden of manual verification. This shift could lead to more resilient cloud infrastructures and a more efficient allocation of cybersecurity resources, ultimately enhancing the overall security posture of U.S. businesses and government entities.
What's Next?
Tamnoon plans to publish a 'Cloud Remediation Index' to track the industry's progress in addressing cloud security findings and will continue to publicly document the remediations its engine declines. The company also encourages buyers to ask remediation vendors to demonstrate their refusal capabilities, suggesting a potential shift in industry standards. As more organizations adopt intelligent remediation tools, the focus will likely move beyond mere detection to effective and safe resolution. This could lead to a new era of cloud security automation where machines not only identify problems but also intelligently decide the best course of action, including when to refrain from acting. The company has raised over $18 million and is working with major clients like Warner Music Group, indicating growing market interest in this approach.
Beyond the Headlines
The concept of a machine that can 'say no' introduces a profound ethical and philosophical dimension to automation. It challenges the traditional view of automation as simply executing predefined tasks and instead posits a system capable of exercising a form of judgment or restraint. This has implications beyond cloud security, potentially influencing the design of AI systems in other critical domains where unintended consequences can be severe. The emphasis on 'earning' autonomy, where the engine is granted the right to act only after demonstrating a reliable track record, reflects a cautious and responsible approach to deploying powerful AI. This model could foster greater trust in AI-driven systems, paving the way for more sophisticated and autonomous operations across various industries, while also highlighting the importance of transparency and accountability in automated decision-making.
