Security waste AI tokens on Fixes Developers Never Merge. Green AI Remediation from Phoenix Security turns off waste

Green Remediation Sequence

Green Remediation High level AI Remediation ASPM Sequence

Green Remediation High level AI Remediation ASPM PR Remedy

Phoenix Security ASPM Green Remediation

Security teams pick the findings, see the price before any model runs, and decide when a pull request reaches the repository.

SAN FRANCISCO, CA, UNITED STATES, November 5, 2026 /EINPresswire.com/ -- Vulnerability management and AppSec teams adopting AI remediation are getting automated pull requests their developers do not merge. Each one costs a model to produce and reviewer hours to dismiss, and it lands on a service whose owner never asked for it and cannot tell whether the upgrade will break the build. Phoenix Security today announced general availability of Green AI Remedy, the SCA remediation flow in Phoenix Green, its agentic remediation pipeline.

Green AI Remedy starts from findings a security team has already prioritised in Phoenix. Before anything is charged, it shows the scope and a cost estimate in US dollars. It then assesses each repository as it stands and returns a plan with the evidence for every finding. A pull request opens only when a person with the right permission clicks to publish it. The finding closes when the next scan confirms the fix.
Where the cost lands
Most fix tools work per repository and propose an upgrade for everything they can see. A security engineer works from a short list: the findings that are reachable, listed in CISA KEV or high on EPSS, and owned by a known team. When a tool ignores that list, the findings that matter end up buried among routine version bumps.
The owner of the service then has to decide whether to trust each change. If a pull request doesn't say which findings it addresses or leaves behind, the reviewer has to rebuild that context by hand. Developers learn to close these pull requests unread, and the security team ends up paying for model calls that change nothing in production.

Remediation starts from the backlog the team already trusts. A plan is created in a few clicks from the Libraries view, a build file, an asset, a team dashboard or a library's remediation details. The selection is exact: only the chosen findings enter the plan. Phoenix groups them by repository, branch, and build file, and lists anything it cannot map to a repository with confidence as an exclusion with a reason.

Each vulnerability is fixed once, in the layer it lives in. Phoenix's contextual deduplication merges the SCA and container findings for the same vulnerable library before the agent is involved, and container lineage shows whether that library comes from the application or from the base image. Where the base image is the source, Phoenix points the owning team to the latest base image instead of proposing a build-file edit. The agent's budget goes to the findings that need a code change.

Reviewer time replaces token burn. The opening screen shows the finding count, repositories, exclusions, and an estimate in US dollars against the organisation's remaining budget, all before the first model call. The agent then assesses each repository at a pinned commit and returns the proposed changes with the findings each covers, the candidates it deferred and why, a status for every finding, and the validation that ran. Publishing is a separate action. If the base branch has moved since the assessment, Phoenix asks for a new one before pushing anything.
Context first, then the agent
Green is the final step in a workflow that begins by reducing volume. Phoenix correlates code and cloud findings, removes duplicates across scanners, and applies reachability, exploitability, deployment context, and ownership before anyone selects what to fix. ClearBank, a Phoenix customer, reported a 98% reduction in container vulnerabilities after applying that context. Green's agent works on what is left.
Selection can draw on public exploitation signals, including the CISA Known Exploited Vulnerabilities catalog and EPSS scores, alongside Phoenix's own reachability analysis. Phoenix Security was named a Major Player in the IDC MarketScape: Worldwide ASPM 2025 Vendor Assessment.
How teams use it

A vulnerability manager filters the backlog to reachable findings listed in CISA KEV and picks one library that appears across three Java services. Phoenix has already merged each service's SCA and container findings for that library into a single entry. Two services declare the library in their build files, so they go into the plan. In the third, the library ships inside the container base image, so Phoenix routes it to the platform team, recommending the latest base image as the fix rather than running an agent on a build-file change that wouldn't remove it.

The scope screen shows the two repositories, the base-image exclusion with its reason, and the estimate against the monthly budget. The manager starts the assessment and closes the panel. The run continues in the background, and the plan waits under Security > Remediation plans.
The next morning, the owning engineering team reads the status for each finding before the diff, routes the two marked for review to the engineer who knows the service, and publishes one pull request per repository. They merge through their usual process. The platform team rebuilds on the updated base image. The following scan closes the SCA and container findings together.

Availability
Green AI Remedy is generally available today for Phoenix customers. It covers SCA findings in repositories connected to Phoenix and runs on the organisation's own model key, configured under Settings > Organization > AI settings. Starting an assessment and publishing a pull request require a dedicated permission, which organization administrators, security administrators, and security developers have by default. Documentation is available at phoenix.security.

Phil Moroni
Phoenix Security
+1 919-594-8888
Visit us on social media:
LinkedIn
Instagram
Facebook
YouTube
X