A Singapore Government Agency Website
How to identify
How might we help engineers to automate the remediation of security findings so that we can reduce security exposure across government systems?
Security operators who identify findings and engineering teams who implement fixes across government agency systems, including security leads, cloud engineers, DevSecOps practitioners, and application developers.
When a security finding is identified, such as a misconfigured cloud resource, a non-compliant code pattern, or a vulnerable dependency, someone must interpret what the finding means, determine the correct fix within the specific codebase or infrastructure, and implement it through the standard development workflow.
Remediation sits at the boundary between two domains of expertise. Security teams can identify and contextualise findings but typically cannot modify the infrastructure or application code. Engineering teams can implement changes but may not understand the security implications well enough to determine the correct fix. Coordination between these teams loses context at each handoff, introduces delay, and produces inconsistent outcomes. In user research, vendor and engineering teams handle the majority of remediation but lack direct access to the security tooling where findings originate. Each finding requires its own interpretation-to-implementation cycle, and systems typically carry tens to hundreds of open findings.
Findings remain open beyond their acceptable risk window. Remediation quality depends on whichever team carries the finding at the point of handoff rather than on a consistent standard. Backlogs grow faster than they are resolved, compliance posture degrades across reporting cycles, and the organisation cannot demonstrate timely response to identified risk.
User research was conducted making use of user interviews with current users of CloudSCAPE, which are mainly security engineers. 6 of them were conducted as they were users we had previously engaged, and it would allow us to gain deeper insights.
The assumptions we have made with our feature is that:
We have gotten buy-ins from a couple of agencies including BCA, MTI and MOE based on some of our initial engagements and they are keen to explore our solution.
There is buy-in from CSG management as well for us to work on this solution as well.
AI agents will help along various processes of the remediation process, with the main work done by the remediation agent that automatically generates a fix to the IaC repository that is ready to be reviewed and deployed.
We ensure that the tracking of fixes on the platform requires minimal switching:
(No user testing on the prototype has been done yet, will fill this section once done)
We plan to get a pilot of about 6-8 users to deeply engage on their experience before rolling the feature out to more agencies. The goal will be to reduce the number of non-compliant findings that aren't suppressed by 20-30%.