VERA · MVP in progress

Turn a vulnerability finding into a controlled remediation outcome.

VERA orchestrates the work between vulnerability intelligence and a safe release: correlating affected artifacts, applying policy, rebuilding, validating, signing, publishing, deploying, or packaging—with evidence at each gate.

Explore the workflow Discuss a remediation workflow
MVP in progress Policy-governed Evidence-backed Human approval where required
The gap

Detection is not remediation.

Enterprise vulnerability programs still depend on manual triage, ownership discovery, rebuild coordination, approvals, and deployment scheduling. Scanners find risk; they rarely reconstruct and redeploy corrected artifacts.

  • High volumes from SCA, container, registry, and runtime scanning without a shared remediation path.
  • Hard mapping from a finding to the right repository, image digest, owner, and runtime.
  • Inconsistent rebuilds, weak provenance, and no reliable proof that a fix reached production.
  • Client-hosted and air-gapped environments where the provider does not control deployment.
Remediation path

Orchestrate the lifecycle—not just the patch.

A technical fix is only useful when it can be traced to the affected artifact, pass quality and security gates, and reach the intended environment safely.

01 / INTAKENormalizeIngest and validate vulnerability findings
02 / CONTEXTCorrelateMap artifact, source, pipeline, runtime, and owner
03 / DECIDEPlanChoose a policy-approved remediation path
04 / PROVEValidateBuild, test, rescan, produce SBOM, and sign
05 / DELIVERReleaseDeploy, package, or generate an offline bundle
Business outcomes

Close the window between finding and fix.

VERA is built for teams that must remediate container and library exposure across SaaS-hosted, client-hosted, and restricted runtimes.

Faster remediation

Reduce timelines from weeks or months to minutes or hours where fixes are automatable.

Less manual toil

Remove engineering bottlenecks for standard container rebuilds and safe library upgrades.

Audit-ready evidence

Link findings to signed digests, SBOMs, provenance, approvals, and release outcomes.

Consistent workflows

Enforce the same rebuild, validation, and release path across teams and applications.

Multi-model delivery

Support SaaS deploy, client-controlled packages, and signed air-gapped bundles.

Exception clarity

When automation cannot proceed safely, escalate or document a time-bound exception.

Exposure, not ticket volume

Prioritize what can affect a real workload.

VERA’s decision model combines vulnerability severity with artifact, deployment, ownership, runtime, fix availability, and policy context.

  • Group duplicate findings around immutable artifacts and affected workloads.
  • Separate a scanner observation from a validated remediation decision.
  • Track one plan from intake through release, rollback, exception, or client action.
  • Preserve links among the original finding, rebuilt digest, tests, scan result, SBOM, signature, approval, and outcome.
Guardrails

Autonomy stops at explicit gates.

VERA is designed to orchestrate repeatable remediation while keeping deployment authority, policy exceptions, and high-impact decisions controlled.

Policy decisions

Severity, exploitability, upgrade type, environment, SLA, and organizational rules determine the allowed path.

Fail-capable validation

Builds, tests, rescans, contracts, and negative controls must be capable of blocking a bad release.

Human approvals

Major upgrades, production releases, exceptions, and uncertain paths can require an authorized reviewer.

Artifact trust

Release candidates link immutable digests, SBOMs, signatures, build identity, and validation results.

Idempotent workflows

Durable orchestration is intended to avoid duplicate rebuilds and make retries and failure states visible.

Rollback and exception

Unsafe outcomes stop; authorized workflows can roll back or document compensating controls and expiry.

Current MVP

A working foundation, with integrations still maturing.

MVP scope focuses on container images and software libraries. Application source-code auto-patching is deferred. VERA’s local stack currently exercises a mock remediation path while real integration coverage is developed and validated.

Implemented foundation

API, web experience, durable workflow orchestration, relational state, policy evaluation, mock integration services, and evidence-bearing release candidates.

Initial integration direction

Prisma Cloud findings, GitHub/Jenkins workflows, artifact registries, signing, EKS/ECS targets, and client-controlled delivery patterns.

Honest boundary

MVP in progress does not mean unattended production remediation is generally available. Integrations and control paths require environment-specific validation.

Evidence

Every transition should be defensible.

VERA creates an audit-friendly chain from the original scanner finding to the policy decision, plan, build, tests, scan, SBOM, signature, approval, release, deployment, rollback, package, or exception.

AURA is the planned portfolio layer for translating that Horizon evidence into native customer security-platform records and correlation content.

01
Finding

What was observed, where, and by which source?

02
Decision

Which policy and evidence justified the path?

03
Outcome

What changed, what passed, and what reached the target?

VERA

Where does remediation break down in your environment?

We are validating the integration, approval, release, client-hosted, and air-gapped paths that matter in real vulnerability programs.

Start a conversation Explore the portfolio