Factory launches Security Factory to turn findings into tested fixes

Connecting fragmented security signals

Factory says Security Factory brings together investigation, remediation and verification by connecting signals from existing security and operational tools. Its Connectors consolidate findings from static analysis, dependency and secret scanners, and infrastructure security tools with information from threat intelligence, asset inventories, issue trackers and team conversations.

The company says these sources provide different parts of the security picture. Scanners can identify a potential vulnerability, asset inventories can show where affected software is deployed, and threat intelligence can provide evidence of exploitation in the wild. Jira tickets and Slack threads can add information about previous investigations, ownership and operational constraints.

Security Factory also combines these signals with Security Review, which applies STRIDE, OWASP and supply-chain security methodologies to pull requests and full-codebase audits. Factory says this gives agents the context needed to investigate findings within an organization's environment.

Agents investigate risk and prepare fixes

Security Factory is designed to help teams determine which findings pose real risk, rather than relying on scanner severity alone. Factory describes investigations that assess reachability, validate exploitability and identify attack paths that could link vulnerabilities and misconfigurations to sensitive systems or data.

Its Workstreams allow agents to divide investigations into specialized tasks, examine findings in parallel and retain context across long-running work. Durable state and shared context preserve progress, evidence and unresolved questions. Secure execution environments support reproducing vulnerabilities and testing exploit hypotheses on Droid Computers, in an OS-level sandbox or in a customer's cloud with OpenCompute.

According to Factory, the result of triage is a set of validated findings supported by evidence about what is affected, how it can be exploited and what an attacker could access. That evidence then moves into Factory's coding workflows, including Automations, SDK, Droid CLI and its desktop application.

Agents can use vulnerability details, affected code and reproduction evidence to develop patches, test them against the original exploit conditions, check for regressions and prepare pull requests for engineering review. Possible remediation may include patching code, upgrading a dependency, restricting permissions, rotating a credential or correcting an infrastructure configuration.

Private Preview gives enterprises control over automation

Factory says organizations can configure how much autonomy agents have. They can present remediation plans for human approval, or automatically create pull requests and deploy fixes within approved policies.

The company positions security investigations as software engineering workloads because they involve navigating codebases, tracing attacker-controlled inputs and examining dependencies, permissions and deployment configurations. Security Factory connects that work with the changes, testing and deployment needed to address vulnerabilities.

Factory says secure execution, configurable policies, audit trails and human approval are intended to give enterprises control over the process. Security Factory is opening to a select group of customers in Private Preview. Teams interested in access can contact their account manager, and Factory directs users to its documentation for more information.