Cloud Security Startup Tamnoon Launches Remediation Index and Refusal Benchmarks

Cloud security automation startup Tamnoon announced the release of its Cloud Remediation Index alongside a public log detailing automated fixes its platform explicitly declined to execute. Founded by Chief Executive Officer Marina Segal, the company is urging enterprise security teams to prioritize context and operational safety over raw speed when addressing cloud misconfigurations, as reported by The Next Web (https://thenextweb.com/news/marina-segal-tamnoon-cloud-remediation-say-no).

Segal, who previously worked at Dome9 Security prior to its acquisition by Check Point, co-founded Tamnoon in 2021 to address remediation backlogs in cloud administration. While modern security scanners identify misconfigurations across cloud environments within minutes, resolving those vulnerabilities remains slow. Analyzing data from 14.86 million detections across 17 scanning platforms—including Wiz and CrowdStrike Falcon Cloud Security—Tamnoon reported that over half of all cloud security issues ever detected remain unaddressed.

The metrics underline an operational gap between attackers and enterprise defenders. While CrowdStrike research indicates threat actors can move laterally within 29 minutes of initial access, Tamnoon’s index indicates that resolving a critical cloud finding takes an average of 150 days. Enterprise IT and security teams frequently delay automated fixes out of concern that automated script execution could disrupt live production environments and trigger unplanned downtime.

To address operational risk, Tamnoon designed its remediation engine to evaluate context before executing automated actions. Prior to altering customer infrastructure, the engine evaluates dependencies, asset ownership, recent configuration changes, and live network traffic. If the platform cannot verify that an automated change is safe, it declines the execution, issuing a document detailing the rationale alongside manual step-by-step resolution instructions.

The software operates under a permission model that initially connects with read-only access. Enterprise customers retain veto authority and grant write permissions incrementally across specific threat categories only after the engine establishes a verified record. Every action taken or refused by the engine generates a six-field audit record designed for compliance reporting.

During platform demonstrations, the engine evaluates groups of identical scanner alerts to separate safe modifications from risky ones. When analyzing six identical storage bucket misconfiguration alerts, the engine closes three verified safe targets, declines two due to active system dependencies, and flags the final target for human review owing to unverified asset ownership. On average, Tamnoon’s cross-scanner aggregation model consolidates 142 individual scanner alerts into a single actionable issue.

Tamnoon has raised more than $18 million in venture funding, including a Series A round led by Bright Pixel Capital. Its corporate client roster includes Warner Music Group. According to company metrics, one enterprise customer reduced open security findings from 6,074 to 2,041 over four quarters while recording a 93% decrease in incoming new alerts, while a healthcare customer lowered its per-finding remediation cost from $8,775 for manual fixes to $775 through the engine.