Same-day AI fix proposals for vulnerabilities across every supported release
A continuous, AI-assisted vulnerability management program for a graph database platform company, combining automated daily scanning, AI-driven remediation, and mandatory human review and QA sign-off before any fix reaches a release.
Outcome
Every supported and code-frozen product version scanned daily, fixable vulnerabilities moving from multi-day manual effort to same-day fix proposals, and a documented record for every resolved or accepted risk.
Graph database platform company, maintaining multiple active and code-frozen product release lines
Engagement
Quality engineering, run as a continuous, AI-assisted vulnerability management program
Scope
Every actively supported and code-frozen product version, tracked at the CVE, version, and component level
Business owner
QA and engineering leadership, with owning teams reviewing every fix
Maps to below services
Agentic AI & AgentOps, MLOps & Scalable ML Platforms
Where it started
Security exposure spread across every supported release line, with each fix moving at the pace of manual research.
Business problem
Customer security reviews, audits, and compliance requirements call for evidence that every supported product version is covered for known vulnerabilities. Each fix took multi-day manual effort to research, prepare, and raise for review.
No decision framework
Exposure across active and code-frozen versions needed tracking at the level of CVE, version, and component, which manual spreadsheet tracking could not keep current. Leadership had no at-a-glance view of exposure by severity or owning team.
Agivant's role
Quality engineering, AI remediation agent build, scanning automation, and audit-ready tracking across every supported release
What Agivant built
Agivant's QE team built and runs the program in three stages: scan, fix, and approve. Aqua Security scans every product image daily, an AI agent built on Anthropic's Claude prepares fixes and opens pull requests, and nothing merges until an engineer reviews it and tests pass. Value in days and weeks.
Daily automated scanning
Every supported product image scanned daily against current vulnerability databases, across active and code-frozen release lines.
Exposure tracking
Each finding logged automatically at the CVE, product version, and affected component level, for a real-time inventory of open vulnerabilities.
AI remediation agent
Analyzes each fixable vulnerability, prepares the dependency or code update, and opens a pull request for engineering review.
Mandatory human sign-off
An engineer on the owning team reviews and tests every AI-authored change, and QA approves it before release.
Live tracking dashboard
Exposure by version, severity, and owning team at a glance for QA and engineering leadership.
Auditable status history
Every vulnerability carries a documented, resumable history across open, in review, fixed, and blocked.
How it is built
Scanning
AI remediation
Workflow
Coverage
Controls
Aqua Security
Anthropic Claude
Pull requests into the owning team's review
All active and code-frozen release lines
Engineer review, passing tests, QA sign-off
Before
Manual research for each fix, multi-day turnaround, and exposure tracked by hand in spreadsheets.
After
Daily scans feeding a live exposure inventory, an AI agent proposing same-day fixes as pull requests, and human approval gating every merge.
Proof in production
Every day, Aqua Security scans each supported image and logs new exposures against the right version and component. The Claude agent picks up each fixable vulnerability, prepares the update, and opens a pull request the same day. An engineer on the owning team reviews and tests it, QA signs off, and the status history records every step from open to fixed.
Measured results
Continuous, auditable security coverage, with mean time to remediate materially reduced.
Daily
Scans across every supported product image
Same-day
Fix proposals, previously multi-day manual effort
Every fix
Engineer-reviewed and tested before merge
Full
Detection-to-resolution traceability
The repeatable pattern
Reusable asset
The scan, fix, and approve pattern, with an AI agent proposing changes and humans approving them, carries to any release line or product estate that needs continuous, evidence-based security coverage. Every build amplifies the next.
Challenges overcome
Keeping AI-authored changes under full human control, covering code-frozen versions as carefully as active ones, and keeping the process resumable so any interrupted remediation picks up where it stopped.
.png)