Fix what your scanner finds
Your scanner found it. ACSE closes it, with proof.
You likely have more findings than people to fix them. ACSE takes a misconfiguration, whether its own checks found it or the tools you already run did, and turns it into a change your engineers review in their own code. Then it re-reads the cloud to confirm the fix and keeps the record.
A backlog that gets shorter
Findings leave the queue as validated fixes, not as tickets passed to another team.
Keep the tools you trust
There is nothing to rip out. Findings from your existing tools and from ACSE’s own detection meet in one fix queue.
Closed means verified
A case closes when the cloud shows the fix took hold, not when someone marks it done.
From a finding to a closed case
What happens to each finding
The same steps apply whoever detected the problem, so every fix carries the same evidence.
- Take in the findingACSE reads it from its own checks or from your existing tools, matches it to the resource and removes duplicates.
- Find the code that owns itACSE resolves the repository, file and module behind the resource, or labels it as created in a console.
- Prepare and test the changeA deterministic engine writes the fix from rules, runs
terraform planoffline and re-checks the planned state against your policy. - A person decidesAn approver reviews the change, its blast radius and how to undo it, then decides with step-up MFA.
- Verify and sealAfter your team merges, ACSE re-reads the resource, watches it for an observation window, then seals the case.
One queue
It doesn’t matter who found it
Most teams run more than one tool, and the same misconfiguration often shows up twice. ACSE brings findings from your security platform and cloud-native services into one queue alongside its own detection, and maps each to the check it corresponds to.
From there, every finding is handled the same way: one fix, one approval, one record. Your auditor sees a single history, not a reconciliation across tools.
- Findings from existing tools and ACSE’s own checks
- Duplicates merged into one case
- The same validation and evidence for every fix
Every kind of resource
A precise next step, every time
Not every resource is managed in code, and not every risk should be fixed today. Each finding still gets a reviewable path to closure.
Draft pull request
For Terraform on GitHub: the fix at the exact commit, validated before anyone reviews it.
Signed patch
For repositories where ACSE has read-only access: a signed patch your team applies, tracked to the merge.
CLI runbook
For resources created in a console: read-only checks and the commands to fix them, for a person to run.
Time-bound exception
For risk you choose to accept: a named owner, a justification and an expiry date. When it lapses, the case reopens.
How a case closes
A finding isn’t closed when someone says so. It’s closed when the cloud says so.
After the merge, ACSE re-reads the resource through the same check that found the problem. If it drifts during the observation window, the case reopens.
Questions
What people ask us
Do we need to stop using our current scanner?
No. ACSE is designed to sit after detection. Keep the tools your team relies on and let ACSE handle the fix, the approval and the evidence.
What if there’s no automated fix for a finding?
ACSE still gives you a precise path: a CLI runbook for a person to run, or a time-bound exception with an owner. If you turn on ACSE’s optional AI, it can draft a patch, which goes through the same validation and human approval as any other fix.
Will ACSE open a flood of pull requests?
Duplicates are merged into one case, and a fix in a shared module can close the finding for every consumer under one approval. Every pull request opens as a draft, so nothing reaches your pipeline until a person approves it and your team merges.
Does ACSE write to our cloud to fix things?
Never. Fixes reach you as code, a patch or a runbook. Your own pipeline makes the change.
Keep reading
Related
Fix
ACSE turns a cloud misconfiguration into a validated pull request in your own Terraform, generated by rules and approved by a person. Never auto-merged.
ReadPlatformDetect
ACSE checks every resource in your clouds against the frameworks you choose, from inside your own account, and explains each finding in plain words.
ReadPlatformIntegrations
ACSE works with the tools your teams already use: GitHub and Terraform for fixes, your OIDC identity provider for sign-in and MFA, Teams and your SIEM.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.