Tamnoon Leverages Amazon Bedrock for AI-Powered Cloud Security Remediation

About Tamnoon and Tami

Tamnoon is an AI-powered platform designed to work alongside existing Cloud-Native Application Protection Platforms (CNAPPs) and cloud security posture management tools. Its core AI assistant, Tami, empowers human cloud security experts by automating the investigation, prioritization, and safe remediation of misconfigurations and security issues across multi-cloud environments, including AWS, Azure, and Google Cloud. Tamnoon's approach normalizes findings from a customer's existing tools into a unified format, transforming them into validated, production-safe fixes. The platform emphasizes that the majority of the work, including thorough investigation and remediation planning, occurs before any changes are made to live environments, thereby building trust in automated remediation at scale.

Addressing Cloud Security Remediation Challenges

The current landscape of cloud security remediation presents several significant hurdles. Security engineers often spend hours investigating individual findings, many of which stem from the same root cause. This leads to an overwhelming alert volume that outpaces available headcount, leaving critical exposures unresolved for extended periods. The investigation process itself is manual and repetitive, requiring engineers to gather context on resource ownership, dependencies, and the potential impact of a fix. This time-consuming effort is compounded by a pervasive fear of production impact, which makes teams hesitant to automate remediation without absolute confidence in the safety of proposed changes. Furthermore, reactive prioritization, lacking effective methods for clustering related findings or scoring remediation confidence, forces teams to address alerts linearly rather than tackling root causes that could resolve multiple issues simultaneously. Tamnoon's solution is architected to address this entire pipeline, treating these challenges as interconnected problems rather than isolated incidents.

Solution Overview: An Agentic Architecture

Tamnoon's platform guides users from the initial security finding to the execution of a fix. It ingests findings from CNAPPs, Cloud Security Posture Management (CSPM) providers, and other security tools, normalizing them into a unified schema and enriching them with asset and exposure context for prioritization. The core of the solution lies in its agentic layer, which utilizes a set of specialized AI agents operating within an event-driven, serverless architecture on AWS. This design ensures that each stage of the remediation process scales independently and fails safely. The platform delegates distinct phases of the remediation pipeline to four specialized agents: an investigation agent that reasons through context and validation layers; a safety-scoring agent that classifies remediation risk; a remediation agent that plans ordered, dependency-aware fixes; and a code-generation agent that translates plans into executable code, all while adhering to strict guardrails and review processes.

The Role of Amazon Bedrock

The selection of Amazon Bedrock as the foundation model platform was a pivotal decision for Tamnoon. The platform's diverse remediation agents require different types of foundation models (FMs) – some for deep investigative reasoning, others for high-volume validation, and still others for code review. Amazon Bedrock's single API allows each agent to access the most suitable FM for its specific task, whether it's a highly capable model for complex reasoning or a more efficient model for repetitive tasks. This flexibility eliminates the need for multiple integrations and allows for easier model swapping or upgrades as the AI landscape evolves. Operational overhead was also a key consideration; Amazon Bedrock's Cross-Region inference automatically handles traffic distribution and capacity management, routing requests to the optimal AWS Region without custom routing code. Crucially, for a cloud security company, security was paramount. Amazon Bedrock ensures that inference runs within Tamnoon's own AWS environment under AWS Identity and Access Management (IAM)-scoped permissions, meaning sensitive customer data never leaves the trust boundary, aligning with Tamnoon's own stringent security standards.

Integration with Existing Security Tools

Tamnoon is designed to complement, not replace, the security tools organizations already use. It integrates downstream of detection tools such as Wiz, CrowdStrike, Palo Alto Cortex, Upwind, SentinelOne, Orca, and Cyera, as well as cloud-native services like AWS Security Hub and Amazon GuardDuty. Through API-based integrations, Tamnoon normalizes findings from these diverse sources into a common format, ensuring consistency regardless of the origin. The platform then provides the end-to-end remediation capabilities, assigning a Remediation Confidence Indicator (RCI) of SAFE, RISKY, or AWAITING DATA to each finding. This indicator clearly communicates to teams which actions can be automated and which require human oversight, facilitating a more efficient and trustworthy remediation workflow.

Maintaining Zero Production Issues

Achieving zero production issues is a core tenet of Tamnoon's service, underpinned by a defense-in-depth safety architecture. This process begins before any remediation is drafted, with an independent safety assessment that deliberately prioritizes caution. The platform enforces a strict separation between read-only investigation steps and the remediation path, which includes backup, verification, and rollback procedures for every change. Continuous self-critique is embedded, with each generation step followed by a reflection phase that checks and refines the output. Agent outputs are rigorously validated against automation results, user feedback, and real-world training data. When a model cannot reach an accurate conclusion independently, human engineers are brought into the loop. The final safeguard involves brokering execution through short-lived, tenant-scoped credentials under customer-controlled trust, running in an isolated environment separate from the planning agents. This entire process is wrapped in human governance, with remediations flowing through approval workflows and a comprehensive audit trail, ensuring all AI capabilities are internally proven before customer deployment.

Data Security and Compliance

Tami processes sensitive customer data, including alert payloads, resource identifiers, and misconfiguration details. Ensuring this data remains within the AWS trust boundary, operates with least privilege, and stays auditable is critical. Amazon Bedrock facilitates this by invoking Anthropic Claude via the ChatBedrockConverse interface, keeping the AI supply chain within a single AWS native service. Inference occurs entirely within Tamnoon's AWS accounts, preventing data from leaving AWS. Amazon Bedrock does not retain or train on prompts or completions, further safeguarding customer data from external vendors. Amazon Bedrock Guardrails are applied to every request and response, masking sensitive data, protecting against prompt injection, and ensuring model output remains scoped to security remediation. Each service operates with dedicated per-service IAM execution roles, adhering to the principle of least privilege. Multi-tenant isolation is enforced through OAuth2 client credentials and tenant context attached to each processed message, ensuring strict separation of data. The entire platform is managed as code using AWS CloudFormation and SAM templates, providing transparency and reviewability for all configurations, including pinned model versions for deterministic behavior and robust failure handling with observable error queues and alarms.

Results and Impact

Tami has analyzed over 14 million cloud alerts, demonstrating significant impact across Tamnoon's customer base. For a typical customer, critical cloud exposure is reduced by up to 90% within 90 days. Remediation efficiency sees improvements of up to 100x through root-cause clustering, transforming thousands of raw alerts into actionable insights. Crucially, the platform has maintained zero production issues across millions of workloads, alleviating the common fear of automation-induced downtime. This efficiency translates directly into saved engineer time, with over 13,000 hours saved per week across the customer base, as documented in Tamnoon's 2026 State of Cloud Remediation report. These results highlight a consistent pattern of fewer open exposures, drastically reduced manual effort, and uninterrupted operations.

Conclusion

Building an AI agent capable of reasoning about cloud security findings is achievable, but creating one that can be trusted to act autonomously in production environments presents a far greater challenge. Amazon Bedrock, as a fully managed service, provides access to high-performing foundation models alongside essential tools for building agentic applications, including orchestration, tool use, and guardrails, all accessible through a unified API. This combination is particularly vital for acting on production cloud infrastructure, demanding both robust reasoning capabilities and stringent safety boundaries. Tamnoon's approach ensures that exposures are actually closed, autonomy scales without production risk through confidence ratings, and the solution leverages existing security investments. Ultimately, this allows team capacity to scale efficiently, enabling more exposures to be closed per analyst without requiring additional headcount, marking a significant advancement in cloud security remediation.