---
type: "post"
id: "how-tamnoon-built-ai-powered-cloud-security-remediation-f9b887"
slug: "how-tamnoon-built-ai-powered-cloud-security-remediation-f9b887"
title: "How Tamnoon built AI-powered cloud security remediation with Amazon Bedrock"
description: "Tamnoon’s case makes the remediation pipeline, rather than a single model call, the operative unit of cloud-security automation."
retrieval_nugget: "Tamnoon’s case makes the remediation pipeline, rather than a single model call, the operative unit of cloud-security automation."
published_at: "2026-10-14"
updated_at: "2026-10-14"
record_date: "2026-10-14"
date_kind: "published_at"
topics: ["security"]
source_urls: ["https://aws.amazon.com/blogs/machine-learning/how-tamnoon-built-ai-powered-cloud-security-remediation-with-amazon-bedrock"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:how-tamnoon-built-ai-powered-cloud-security-remediation-f9b887"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:47a07723ebf3c265fe2888039da06f93c1dcb559e8e6f486aa33ed1952ad3987","reviewed_at":"2026-10-14T16:11:11.618Z","source_evidence_count":1,"verified_claim_count":2,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":2,"implication_count":1,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Safe remediation depends on separating investigation, confidence assessment, and execution behind governance controls.","observed_facts":[{"text":"AWS describes Tami as built on Amazon Bedrock and using specialized agents in an event-driven, serverless AWS architecture.","source_urls":["https://aws.amazon.com/blogs/machine-learning/how-tamnoon-built-ai-powered-cloud-security-remediation-with-amazon-bedrock"]},{"text":"AWS says the approach produced an over-90-percent reduction in critical cloud exposure in 90 days with zero production issues.","source_urls":["https://aws.amazon.com/blogs/machine-learning/how-tamnoon-built-ai-powered-cloud-security-remediation-with-amazon-bedrock"]}],"mechanism":"The system gathers context and plans remediation before live changes, then applies guardrails and governance where customer cloud changes are involved.","why_now":"Cloud scanners can generate more findings than teams can manually investigate, while production-risk concerns keep fixes from being automated.","implications":["Agentic security remediation should be evaluated by safely closed findings and production impact, not by the number of alerts an agent can process."],"evidence_boundary":"This is an AWS-published vendor case study; the supplied source excerpt does not provide independent validation or detailed definitions and measurement methods for the reported outcome.","watch_conditions":["Whether Tamnoon or a customer publishes independently inspectable methodology, baseline data, and repeatable results across environments."],"related_records":[],"new_branch_reason":"No prior New Runtime record is supplied; this case warrants a distinct record about staged, governed agentic cloud-security remediation."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/how-tamnoon-built-ai-powered-cloud-security-remediation-f9b887/","markdown":"https://newruntime.com/posts/how-tamnoon-built-ai-powered-cloud-security-remediation-f9b887.md","json":"https://newruntime.com/posts/how-tamnoon-built-ai-powered-cloud-security-remediation-f9b887.json"}
related_patterns: ["harness-architecture-outlives-model-choice"]
---

# How Tamnoon built AI-powered cloud security remediation with Amazon Bedrock

## Retrieval answer

Tamnoon’s case makes the remediation pipeline, rather than a single model call, the operative unit of cloud-security automation.

Tamnoon’s case makes the remediation pipeline, rather than a single model call, the operative unit of cloud-security automation. AWS describes Tami as ingesting findings from CNAPP and cloud-native sources, enriching them with asset and exposure context, and prioritizing them before specialized agents handle remediation stages.

Thesis: Safe remediation depends on separating investigation, confidence assessment, and execution behind governance controls. Observed facts: AWS describes Tami as built on Amazon Bedrock and using specialized agents in an event-driven, serverless AWS architecture; AWS says the approach produced an over-90-percent reduction in critical cloud exposure in 90 days with zero production issues. Mechanism: The system gathers context and plans remediation before live changes, then applies guardrails and governance where customer cloud changes are involved. Why now: Cloud scanners can generate more findings than teams can manually investigate, while production-risk concerns keep fixes from being automated.

First implication: Agentic security remediation should be evaluated by safely closed findings and production impact, not by the number of alerts an agent can process. Evidence boundary: This is an AWS-published vendor case study; the supplied source excerpt does not provide independent validation or detailed definitions and measurement methods for the reported outcome. First watch condition: Whether Tamnoon or a customer publishes independently inspectable methodology, baseline data, and repeatable results across environments. Until then, the figures are a reported case, not general proof that autonomous remediation is safe at scale.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)