53% of critical detections go unaddressed, and the clock runs 150 days
Critical cloud alerts now sit unresolved for 150 days as enterprise security teams lose ground to a 900% increase in high-severity telemetry.
The remediation deficit
The 2026 State of Cloud Remediation report, which analyzed 14.86 million CNAPP detections, shows a widening gap between detection speed and response capacity. Data shows that 53% of all cloud detections now remain open, up from 41% in 2025. This 12 percentage point rise indicates that enterprise security teams are losing ground to telemetry volume.
The problem is most visible in high and critical severity queues. While critical alerts are a small fraction of total volume, managing them is more difficult. Critical volume has grown tenfold, and the Mean Time to Remediate (MTTR) for these risks has risen 17%. A critical alert now stays open for an average of 150 days, compared to under 40 days in 2024.
Structural bottlenecks in the backlog
The cloud security backlog is a structural failure of manual workflows. Vulnerability management closure has slowed by 22%, with the average resolution time extending from 230 to 282 days.
This slowdown persists even as some risk categories improve. Availability alerts fell by 63%, and both IAM hygiene and credential access alerts decreased by 23%. However, 6.3% of detections now touch crown jewel assets (infrastructure critical to business continuity or containing sensitive data).
- TamnoonLeader9.3
Remediation operations
- Owned and reported weekly
- Blast-radius and exploitability
- Reviewed before every change
- Remediation automation tools7.2
Dazz, Opus, Seemplicity
- Routing, not closure
- Rules and ownership mapping
- Depends on playbook quality
- CNAPP native workflows6.8
Wiz, Orca, Defender
- Your engineers
- Severity and attack path
- Left to the ticket owner
- Internal remediation squad6.4
In-house
- Limited by headcount
- Strong on local context
- Strong, but slow
| Player | Backlog burn-down | Prioritization quality | Change-risk review | Score |
|---|---|---|---|---|
| TamnoonLeaderRemediation operations | Owned and reported weekly | Blast-radius and exploitability | Reviewed before every change | 9.3 |
| Remediation automation toolsDazz, Opus, Seemplicity | Routing, not closure | Rules and ownership mapping | Depends on playbook quality | 7.2 |
| CNAPP native workflowsWiz, Orca, Defender | Your engineers | Severity and attack path | Left to the ticket owner | 6.8 |
| Internal remediation squadIn-house | Limited by headcount | Strong on local context | Strong, but slow | 6.4 |
A lack of standardization across the detection layer complicates remediation. Analysis of the Top 35 dataset shows that severity for the same finding differs across CNAPPs in nearly 2% of cases. For example, a security group misconfiguration was flagged as informational by two vendors but critical by three others. Without a unified layer to normalize findings, teams spend time adjudicating severity instead of applying fixes.
| Metric | 2025 Status | 2026 Status | Trend |
|---|---|---|---|
| Open Detections (%) | 41% | 53% | +29% |
| Critical MTTR (Days) | 128 | 150 | +17% |
| Vuln. Management MTTR (Days) | 230 | 282 | +22% |
| Critical Alert Volume | Baseline | 10x Increase | +900% |
The safe fix constraint
Fear of production outages is the primary inhibitor to remediation. Security engineers often lack the context to know if a fix, such as enforcing IMDSv2, will break a service. Data from 2025 showed that failure to enforce IMDSv2 was the most prevalent alert (14.7% of volume), yet fewer than half of EC2 instances enforced it. This suggests hesitation to use automated fixes without impact analysis.
Tamnoon addresses this with a Remediation Confidence Score. It uses blast radius and dependency analysis to categorize a proposed fix as safe, risky, or awaiting data. This allows teams to move toward a managed remediation flow.
Human-supervised agentic remediation
Remediation requires a managed approach that owns the finding through to closure. Tamnoon operates as a tool agnostic layer that integrates with stacks including Wiz, Prisma Cloud, Orca Security, and AWS Security Hub.
The platform uses Tami, an AI cloud security agent. Tami is a multi agent system trained on Tamnoon's remediation history and operates under guardrails. It employs specialized skills to answer foundational questions:
- What is the asset and who owns it?
- What depends on it?
- What has worked for this misconfiguration before?
- What will break if this change is applied?
The output includes CLI commands, IaC templates, and validation scripts to close the loop. Tamnoon states that this automated enrichment handles 90% of the remediation effort.
The role of the CloudPro
Automation is insufficient for the remaining 10% of complex environments. Tamnoon’s model includes CloudPros (human experts who verify AI logic and safety on demand). This human in the loop component enables the service to be measured on findings closed rather than findings surfaced.
For organizations migrating between tools, this model provides a unified workflow above the detection layer. Tamnoon claims to enable full migration in two weeks or less by moving alert rules, Jira or ServiceNow workflows, and CI/CD integrations without losing progress on the existing backlog.
The detect and alert model has reached its limit. As MTTR for critical findings climbs toward 150 days, Tamnoon’s approach of combining agentic automation with human oversight addresses the capacity shortage. A Fortune 1000 healthcare company reported an 87% reduction in cost per remediation using this model.
Advertisement
- 2026 State of Cloud Remediation report analyses 14.86 million cumulative CNAPP detections across hundreds of enterprise environments and 800 accounts
- As of May 2026, 53% of detections remain open, up from 41% in 2025
- Critical alerts stay open on average 150 days, up from under 40 days in 2024; critical volume grew 10x while critical MTTR rose 17%
- Vulnerability management closure slowed 22%, from 230 to 282 days; it is roughly 19% of 2026 alerts
- 6.3% of detections touch a Crown Jewel asset; availability alerts fell 63%; IAM hygiene and credential access each fell 23%
- 2025 report analysed over 4.76 million CNAPP alerts over 12 months; average critical MTTR was 128 days
- failure to enforce IMDSv2 was the most prevalent alert at ~14.7% of volume, with fewer than half of EC2 instances enforcing it; only ~1.5% of S3 buckets were public; compute misconfigurations occurred more than twice as often as storage ones
- severity for the same finding differs across CNAPPs in nearly 2% of the Top 35 dataset; one security-group misconfiguration was informational in two CNAPPs and critical in three others
- Tami is Tamnoon's AI cloud security agent: a multi-agent system using a model trained on Tamnoon's remediation history plus general LLMs under guardrails
- Tamnoon enriches, deduplicates and prioritises alerts by risk and asset criticality (Crown Jewels); outputs CLI commands, IaC templates and validation scripts, stating it handles 90% of the effort; every remediation ships a prevention plan
- Remediation Confidence Score: blast-radius/dependency analysis scoring a fix SAFE, RISKY or AWAITING DATA
- Agentic remediation skills: specialised agents each answering one question (what the asset is, what depends on it, who owns it, what worked before, what breaks)
- Ownership resolved through layered signals rather than stale tags, with human fallback
- CloudPros: human cloud security experts who verify AI logic and safety on demand; CNAPP Copilot is tool-agnostic, bring-your-own-CNAPP, no rip and replace
- Tamnoon states it was accepted into Anthropic's Cyber Verification Program
- A Fortune 1000 healthcare company achieved an 87% reduction in cost-per-remediation
- Integrations named by Tamnoon: Wiz, Check Point CloudGuard, Cortex Cloud, CrowdStrike Falcon Cloud Security, Cyera, Microsoft Defender for Cloud, Orca Security, Prisma Cloud, SentinelOne, Upwind, AWS Security Hub, Google Security Command Center
- Tamnoon states zero production incidents across every remediation Tami has executed to date
- CNAPP migration: alert rules, Jira/ServiceNow workflows, SIEM integrations, CI/CD and IaC scanning, tag-based ownership; claims full migration in two weeks or less with 0% remediation gaps
