How Tamnoon built AI-powered cloud security remediation with Amazon Bedrock
Amazon Web Services Ishara Premadasa
Tamnoon built an AI cloud-remediation system on Amazon Bedrock. It cut critical exposure by over 90% in 90 days, with zero production issues.
Based on reporting by Amazon Web Services, Ishara Premadasa — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Cloud security has a nasty habit of turning into a queue problem. CNAPPs and posture scanners keep finding more issues than teams can inspect, and the gap between “detected” and “fixed” is where risk grows up and starts paying rent.
Tamnoon’s answer is Tami, an agentic remediation orchestrator built on Amazon Bedrock. It sits behind the tools teams already use, pulls in findings from CNAPPs and cloud-native services, normalizes them, enriches them with asset context, and then decides what can be safely fixed. The company says that approach drove an over 90% reduction in critical cloud exposure in 90 days, without production issues.
What makes the system interesting is the split between jobs. One agent investigates and writes a read-only plan. Another scores safety as SAFE, RISKY, or AWAITING DATA, and does so conservatively. A remediation agent only kicks in after safety clears a finding, then lays out backup, remediate, verify steps with rollback guidance. A code-generation agent turns that into executable remediation, but only after guardrails screen for relevance and prompt injection, and a separate reviewer must approve the output.
Bedrock matters here because Tamnoon didn’t want one model doing everything badly. The company routes different tasks to different foundation models through one API: heavier reasoning for hard investigations, cheaper models for high-volume validation, and review-focused models for code quality and cost control. Bedrock Cross-Region inference also handles traffic distribution automatically, while the work stays inside Tamnoon’s AWS environment under IAM-scoped permissions.
The safety story is doing a lot of work, and that’s the point. Tamnoon runs remediation through defense-in-depth: conservative scoring, read-only investigation, backup and rollback steps, self-review, human approval where needed, and execution through short-lived tenant-scoped credentials. In cloud security, that’s the difference between automation and chaos with a faster keyboard.
My take — AI-written commentary, not fact-checked reporting
This is the right kind of AI for security: narrow, audited, and slightly paranoid. The industry keeps trying to replace humans with a model and a prayer, then acts surprised when production gets spicy. Give an agent a fence, a log trail, and permission to be boring, and suddenly automation starts looking sensible.
Read more about this at: Amazon Web Services