01The challenge
The CNAPP found the problems. Nobody owned them.
The CNAPP surfaced misconfigurations across three clouds. But every fix stalled on the same question: whose resource is this? Findings piled up unassigned in the console.
No owner, no fixFindings sat unassigned while teams worked out whose resource it was.
Ownership was guessworkTags were missing or stale, and the people who created resources had moved on.
Console fixes don’t lastA change made by hand can be undone by the next infrastructure-as-code deploy.
Evidence pieced togetherWho owned it, who approved it and what changed had to be rebuilt for every audit.
02The approach
Find the owner first. Then fix, with their approval.
autobotAI makes ownership a first-class step. Every finding is grouped, given an owner, approved and verified before it closes, inside the tools the teams already use.
Fig. 1From orphan finding to resolved
Ingest & correlatethree clouds, de-duplicated
Find the ownertags · creator · CMDB · IaC
Owner approvesTeams card: risk, blast radius, fix
Apply the fixcloud API, or an IaC pull request
Verify & closere-scan · ticket · risk register
Fig. 2Ownership is scored, not guessed
Resource tags
Creator identity
CMDB mapping
IaC git history
Accountable ownerconfidence-scored
Fig. 3No reply? It climbs on SLA timers
Owner
SLATeam lead
SLAAccount owner
03The results
Every finding owned. Every change proven.
Every finding ownedNo unassigned backlog sitting in the CNAPP console.
One approval for productionLow-risk fixes run inside guardrails; production changes wait for the owner.
Fixes that survive deploysChanges land as IaC pull requests, so the next deploy keeps them.
Evidence on tapWho owned it, who approved it and what changed, for every finding.
Escalation without chasingUnanswered findings climb from owner to team lead to account owner.
One process, three cloudsAWS, Azure and Google Cloud findings follow the same closed loop.
