.svg)
Solutions
Prevent and reduce security debt
Stop new debt as agents write, fix the backlog worst first, and handle new CVEs as they land.
Security debt · this weekacme
New from agent code100 risky changes, 88 stopped before merge
+12New CVEs in code you run40 published, 9 match your versions
+9Fixed and mergedAuto-fix pull requests
−86Backlog this week−65
The challenge
New findings arrive faster than teams can fix them.
CVEs published per year
Each quarter, without Heeler
New findings
Fixed
CVE counts: J.P. Morgan, Eye on the Market, "Patchmageddon", July 2026. Quarterly bars are illustrative.
New debt
New debt stopped before it merges.
Risky packages and code are caught where agents write them.
Checked in the agent as it writes
Blocked at commit and in CI
Held at the pull request
Risky changes written by agents100 this week
Written by agents
After the agent's own checks−58 · Agent Skills, MCP
After commit and CI−17 · CLI
Reach the backlog−13 at the PR · PR Guardrails
The backlog
The backlog fixed, worst first.
Autotriage ranks every finding by real exposure. Auto-fix opens the fix.
Ranked by reachability and exposure
Fix PRs validated in your CI
Tracked to your SLOs
Backlog, ranked by Autotriageacme · all repositories
#FindingWhy it ranks herePriorityStatus
1
log4j-core 2.14.1CVE-2021-44228
Function reachableInternet accessibleUrgentMerged2
SQL injectionorders/query.py:88
Tier 1Internet accessibleUrgentMerged3
commons-text 1.9CVE-2022-42889
Function reachableProductionUrgentFix PR, CI green4
jackson-databind 2.9.1014 advisories
Runtime library reachablePlanFix PR, CI greenOpen findings
12 weeks ago
1,240
Today
310
New research
New CVEs sorted the day they land.
Each new CVE is matched to the versions you run and checked for reachability.
Matched to every version you run
Reachable and exposed go first
Urgent ones get a fix PR
Published this week40new CVEs across your ecosystems
Match your versions9matched to every package version you run
Autotriage
3reachable and exposed: Urgent, fix PRs opened
6Plan: fixed on schedule
urllib3 2.0.6 · new advisory · payments-apiUrgent
Function reachableInternet accessibleFix PR #1204 opened
Closed
Closed when production runs the fix.
A finding closes only when the fixed version is deployed.
Fixed when the PR merges
Deployed when every deployment runs it
SLO clock stops at resolution
commons-text 1.9 → 1.10.0SLO met
Activefound Sep 12
FixedPR #988 merged Sep 15
Deployed3 of 3 deployments
orders-api · prod-usSep 16
orders-api · prod-euSep 16
orders-worker · prod-usSep 17
Stop new security debt and pay down the backlog.
