Introducing the Security Factory

Frontier models are becoming exceptionally capable at finding vulnerabilities. The next opportunity lies in fixing them.

Today, we’re introducing Security Factory, which helps engineering teams turn security findings into tested fixes by connecting investigation, remediation, and verification in one continuous workflow. Security Factory is now in Private Preview.

Most large engineering organizations have invested heavily in security tooling. Scanners surface potential vulnerabilities across code and infrastructure. Threat intelligence, asset inventories, Jira tickets, and Slack threads provide additional context about exposure, ownership, and ongoing investigations. Yet these signals remain fragmented, and vulnerability backlogs continue to grow.

The challenge is what happens after a finding is discovered. Validating vulnerabilities, assessing their impact, and coordinating fixes across code, dependencies, and infrastructure still requires substantial manual work. Meanwhile, remediation competes with everything else engineering teams need to ship.

Security Factory applies Factory’s agent infrastructure and coding capabilities to connect three stages of continuous security: signals, triage, and remediation.

Signals, triage, remediation

1. Signals: Bring findings and context together

Security Factory connects to existing tools through Connectors, consolidating findings from static analysis, dependency and secret scanners, and infrastructure security tools alongside context from threat intelligence, asset inventories, issue trackers, and team conversations into a unified workflow.

These sources serve different purposes. A scanner identifies a potential vulnerability. An asset inventory helps establish where affected software is deployed. Threat intelligence provides evidence of exploitation in the wild. Jira tickets and Slack threads capture prior investigations, ownership, and operational constraints.

Factory combines these signals with Security Review, which applies STRIDE, OWASP, and supply-chain security methodologies to pull requests and full-codebase audits. Together, they give agents a foundation for investigating findings in the context of your environment.

2. Triage: Understand which findings pose real risk

Scanners surface potential vulnerabilities across your code and infrastructure. Determining which findings pose real risk requires deeper investigation: assessing reachability, validating exploitability, and identifying attack paths that chain vulnerabilities and misconfigurations to compromise sensitive systems.

Consider a vulnerable internet-facing service and an overprivileged service account. Investigating the vulnerability in isolation may miss the broader exposure. Tracing the attack path can reveal whether compromising the service would give an attacker access to the account’s credentials and, through them, sensitive systems or data.

Security Factory uses Factory's agent infrastructure to coordinate this work. Through Workstreams, agents can divide investigations into specialized tasks, examine findings in parallel, and maintain context across long-running investigations.

This relies on several capabilities:

• Connectors bring together findings and supporting evidence from security tools and operational systems.
• Workstreams coordinate parallel investigations and specialized tasks.
• Durable state and shared context preserve investigation progress, evidence, and unresolved questions so agents can build on previous work.
• Secure execution environments provide controlled environments for reproducing vulnerabilities and testing exploit hypotheses, on Droid Computers, in an OS-level sandbox, or in your own cloud with OpenCompute.

The output of this phase is validated findings backed by evidence: what is affected, how it can be exploited, and what an attacker could access. This gives security teams a prioritized remediation backlog based on demonstrated risk, not scanner severity alone.

3. Remediation: Turn validated findings into verified fixes

Once triage establishes the risk, the next step is to identify the right change. That may mean patching vulnerable code, upgrading a dependency, restricting permissions, rotating a credential, or correcting an infrastructure configuration. The goal is to address the underlying vulnerability or break the attack path without disrupting legitimate behavior.

Security Factory carries the evidence gathered during triage into Factory’s coding workflows, including Automations, SDK, Droid CLI, and our desktop application, so remediation does not start with another investigation from scratch.

Agents can use vulnerability details, affected code, and reproduction evidence to develop fixes, test them against the original exploit conditions, check for regressions, and prepare patches or pull requests for engineering review.

Organizations can configure autonomy levels for agents, from presenting remediation plans for human approval to automatically creating pull requests and deploying fixes within approved policies.

Why Factory

Security investigations are increasingly software engineering workloads. Establishing exploitability requires navigating complex codebases, tracing attacker-controlled inputs, and examining dependencies, permissions, and deployment configurations. Remediation requires changing those systems, testing the changes, and shipping them safely.

These are workflows Factory’s agent infrastructure was built to handle.

The primitives we’ve built into Security Factory connect investigation and remediation in one continuous workflow, carrying context and evidence from the initial finding through to a tested fix. Secure execution, configurable policies, audit trails, and human approval give enterprises control over how that work gets done.

What's next

The era of the unaddressed vulnerability backlog is ending. Remediation is moving towards a continuous engineering process.

We're opening Security Factory to a select group of customers in Private Preview.

If your team is working through similar challenges, we'd like to hear from you. Reach out to your account manager to request Private Preview access.

Learn more about Security Factory in our docs.