Tamnoon today launched the self-healing engine for cloud exposures, built for the half of cloud findings that stay open because nobody will sign the change.
SEATTLE, October 13, 2026. Somewhere in a cloud with a scanner on it, a critical finding turns 150 days old today. It was found on day one. Everyone agreed it should be closed. Nobody closed it, because closing it means changing production, and a change in production has a name on it. Tamnoon today launched the self-healing engine for cloud exposures. It was built for that finding, and for the half of all cloud findings ever detected that are still open for the same reason.
The attackers went agentic first. Their tooling finds an exposure and tries it with no one behind the keyboard, and the window between found and tried keeps shrinking. Defense cannot answer with the same move, and should not. Agents or no agents, one thing has not changed: who answers for a broken production system. That is still the security team, and the person who runs it. So nobody hands an agent the keys to production, the remediate button on every scanner stays off, and the backlog gets worked by hand, one ticket at a time. By Tamnoon's own research, across 14.86 million detections in hundreds of cloud environments and ten cloud security platforms, 53% of findings ever detected are still open, up from 41% a year earlier, and a critical now waits 150 days on average.
Tamnoon's bet is that the problem was never speed. It is who signs. A change gets made when someone can read why it is safe, so the engine does the reading. For every finding a scanner raises, at the pace scanners raise them, it reads what the engineer who owns the change would read: who uses the resource, what depends on it, who owns it, what changed recently. Then it writes a verdict. SAFE comes with a plan, a rollback, and a path through the customer's own change process, owner approving, rescan confirming. RISKY is a decline in writing: what was read, why it stopped, what would change the answer, how to do it by hand. AWAITING DATA names the one fact that lives with a person and asks for it. Autonomy is earned one class of finding at a time. The engine starts read-only, and the customer decides which classes have earned a run without a fresh approval, with the rescan as the check and the receipts as the audit trail.
Most launches show the fix. Tamnoon is showing the refusals. At www.tamnoon.io/the-record are the changes the engine would not make, each with what it read, why it stopped, and what would change its mind. One of them had three approvals. The engine declined it anyway: the change would have cut part of the environment off from the internet. Three people were wrong. Nothing broke. That is the product.
"Every scanner ships a remediate button and almost nobody turns it on, because a change in production has a name on it," said Marina Segal, CEO and cofounder of Tamnoon. "The question to ask a remediation product is not how fast it fixes. It is whether it can refuse, and show you why. So we published ours."
One customer's quarterly reviews went from 6,074 open findings to 2,041 over four quarters, with 93% fewer new alerts arriving by the end.
The engine works with findings from whichever scanner the customer already runs, inside the customer's own change process. Tamnoon's new site is live today at www.tamnoon.io. The research, with its method and limitations, is at www.tamnoon.io/report-2026.
Tamnoon is the self-healing engine for cloud exposures. It investigates every scanner finding on its own, gives each one a written verdict, runs the safe changes through the customer's own change process, and declines the rest in writing, with the evidence. Everyone automates the yes. We mastered the no. Founded in 2021 by Dome9 veterans Marina Segal, Idan Perez and Zohar Alon, Tamnoon has raised more than $18 million from Bright Pixel Capital, Merlin Ventures, Secret Chord Ventures, Blu Ventures, Mindset Ventures, Elron Ventures, Inner Loop Capital and toDay Ventures. www.tamnoon.io
Press contact: [email protected]
Tamnoon publishes what the engine closed and what the engine refused, with the evidence behind both.
