Self-healing for Upwind

Upwind found it in minutes. The finding is still open in month five.

53 percent of everything ever detected is still open. The State of Cloud Remediation 2026, 14.86M detections across hundreds of enterprise environments.

Upwind alone

Upwind plus Tamnoon

An issue opens

Runtime-validated by the eBPF sensor, prioritized

Investigated read-only, then rated

A CVE arrives

Function-level reachability filters out the noise

The reachable ones get a safe fix, or a reasoned refusal

Identical issues

One rule, one answer

Six buckets, three answers

Safe

Risky

Awaiting data

What cannot be proven safe

Stays open

Risky

Declined, with the reason attached

The safe ones

Wait for an engineer

Safe

Closed on your execution plane

An Upwind issue, after the engine has read it.

The queue carries the environment facts that decide the answer. The record carries the change, the owner, the rollback and where it lands in your ticketing.

RecommendationClose public exposure on a production S3 bucket

Made with Tamnoon

Environment: PROD
Exposure: Public
Encryption: True
Resource: S3
Crown jewel: 1
Owner: J. Doe

Severity	Finding	Environment fact	Verdict
Critical	Publicly exposed S3 bucket on the topology map	no flows in 90 days	Safe
High	Runtime-reachable CVE on an internet-facing workload	2 services, live traffic	Risky
Medium	Risky API usage flagged against the cloud baseline	owner unresolved	Awaiting data

Create an initiative from this recommendation? AcceptReject

TMN-85622 · S3 bucket exposed, no live flows on the mapSafe to remediate

RecordEvidenceTicket

Priority	Investigated	Cloud provider	Asset	Status	Lands in
Medium	read-only, 07:40	AWS	s3-archive-prod-052	Safe	Jira

Read-only investigation runs before anything is proposed, and it is the evidence attached to whichever answer comes back. Identifiers on this page are fictional.

Three Upwind issues. Three different answers.

TMN-85619Upwind

Upwind issue: S3 bucket publicly exposed. The Topology Map shows no live flows to it in 90 days, and no policy depends on it.

Investigatedread-only, 10:14

ChangePUBLIC → PRIVATE

Rollbackready before execution

Safeclosed 10:15

Closed at machine speed on your audit trail. Rescan clean.

TMN-85619

Upwind

Upwind issue: S3 bucket publicly exposed. The Topology Map shows no live flows to it in 90 days, and no policy depends on it.

Investigated: read-only, 10:14
Change: PUBLIC → PRIVATE
Rollback: ready before execution

Safe closed 10:15

Closed at machine speed on your audit trail. Rescan clean.

TMN-85620Upwind

Identical rule, identical severity. The map shows two live services reading this bucket over HTTP right now, one of them external.

Investigatedread-only, 10:14

Dependents2 services, live

Changenot executed

Riskydeclined 10:15

Refused, with the reason. The change that would have caused the 3am page was refused at two.

TMN-85620

Upwind

Identical rule, identical severity. The map shows two live services reading this bucket over HTTP right now, one of them external.

Investigated: read-only, 10:14
Dependents: 2 services, live
Change: not executed

Risky declined 10:15

Refused, with the reason. The change that would have caused the 3am page was refused at two.

TMN-85621Upwind

Upwind issue: privilege escalation anomaly on a workload. The owning team cannot be resolved from tags or recent activity.

Investigatedread-only, 10:14

Ownerunresolved

Changenothing touched

Awaiting dataasked 10:15

A third answer, chosen. Ownership could not be resolved, so nothing was touched and the missing context was requested. It does not guess.

TMN-85621

Upwind

Upwind issue: privilege escalation anomaly on a workload. The owning team cannot be resolved from tags or recent activity.

Investigated: read-only, 10:14
Owner: unresolved
Change: nothing touched

Awaiting data asked 10:15

A third answer, chosen. Ownership could not be resolved, so nothing was touched and the missing context was requested. It does not guess.

Identifiers fictional · one healed never travels without the declines beside it

What teams running Upwind ask first.

How is this different from self-healing infrastructure?

Self-healing infrastructure restores desired state: a pod restarts, an instance is replaced, a group scales back up. It is availability automation and it exercises no judgment about safety. Tamnoon heals the security posture instead: it investigates the finding in context, decides whether a change is safe to make at all, refuses what it cannot prove, and leaves the receipt behind. Restarting a pod is not the same as knowing which bucket must stay public.

How is this different from Upwind’s own remediation?

Upwind automates hygiene on its own findings. Tamnoon works on what remains after that. It investigates each issue read-only in your live environment, groups things together to increase efficiency of each action instead of going a single issue at a time, closes what it can prove safe through your own change process, declines what it cannot with the evidence why, and answers for the outcome.

Upwind already validates with runtime. What does Tamnoon add?

Runtime validation answers whether a risk is real. Tamnoon answers the next question: whether the fix is safe to make here, today. A reachable CVE on a workload two services depend on is a real risk and a dangerous change at the same time, and the second fact is the one that keeps it open in month five.

Do we have to change our Upwind setup?

No. Tamnoon sits downstream of the Upwind you already run, reading issues through the API with read access. Your sensor, your baselines and your topology stay exactly as they are. No scanner to replace, no contract to end.

We were burned by auto-remediation. Why is this different?

A tool that fires fixes blind is an autoimmune reaction: it attacks the body it is supposed to protect. Tamnoon starts from the opposite premise. Every fix is investigated read-only first, against live traffic, usage, dependencies and ownership. What it cannot prove safe it refuses, and the refusal ships with the evidence why. You were not wrong to pull the plug on a tool that could not tell you why a change was safe.

What do I tell my change advisory board?

They approve a change class, not a black box. Starting mode is SAFE-only: the engine closes only the class of change your board has approved, through your own change process, under your IAM policies, on your audit trail. Autonomy widens on evidence, class by class, and every decision leaves a record your auditor can read.

Upwind watches runtime. Tamnoon refuses, or closes and signs the fix.

Upwind found it in minutes. The finding is still open in month five.

An Upwind issue, after the engine has read it.

Three Upwind issues. Three different answers.

Tamnoon executes through your change process, not around it.

What teams running Upwind ask first.

See the engine run against your own Upwind console.