Overview

​

Remediations Page

The Remediations page provides a comprehensive view of all ongoing efforts to fix security vulnerabilities across your organization. Remediations can be fully automated by the Backline agents or in Hybrid mode, which requires your collaboration with the agents. Take action, track progress, priorities, and the status of automated and hybrid remediation activities.

​

What You’ll See

​

Remediation Metrics

The top of the page displays key metrics:

• Total active remediations and distribution by mode
• SLA Violations
• Associated Vulnerabilities to be resolved by existing remediations
• Resolved remediations over time
• Median Time to Remediate in the last 30 days

​

Remediation List

Each remediation is displayed as a card showing:

• Title: Description of what’s being fixed
• Type: Vulnerability type being addressed
• Mode: Remediation approach (Automated or Hybrid)
• Priority: Importance level for this remediation
• Repository: Repository where the fix is being applied for code remediations
• Asset Type: Cloud asset type for whom the fix is being applied for cloud remediations
• Assigned Vulnerabilities: Number of vulnerabilities this remediation addresses
• Creation Date: When the remediation was initiated
• SLA Status: Compliance with resolution timelines
• Active Agent: AI agent working on this remediation (if applicable)
• Status: Current state (In Progress, Pending Approval, Resolved, etc.)

​

Remediation Dependencies and Pending Action

Some remediations may depend on another remediation before Backline can continue fixing them. This can happen when a fix requires another related change first, such as upgrading an internal package, updating a shared dependency, or completing a remediation that impacts multiple other findings. Backline identifies these relationships automatically and shows them in the remediation details, so you can understand what is blocking progress and which remediations are affected.

​

Affected Remediations

When a remediation impacts other remediations, Backline shows Affected Remediations. This number represents how many other remediations are waiting for this remediation to be completed. Example: Affected Remediations: 4 Hover over the field to see the list of affected remediations. Each remediation name is clickable, so you can open it directly and review its status.

​

Depends On

When a remediation is waiting for another remediation to be completed, Backline shows Depends On. This number represents how many remediations must be resolved before the current remediation can continue. Example: Depends On: 1 Hover over the field to see the related remediation. Each remediation name is clickable, so you can open the blocking remediation and understand what needs to be completed first.

​

Pending Action Status

Backline uses Pending Action when a remediation is temporarily blocked by another remediation. A remediation in Pending Action has not failed. It is waiting for the related remediation to be completed before Backline can continue. Once the blocking remediation is resolved, Backline can continue the dependent remediation and move it back to In Progress.

​

Vulnerabilities in Pending Action

When a remediation moves to Pending Action, the related vulnerabilities also move to Pending Action. This helps explain why the vulnerability is not currently being remediated and what needs to happen before work can continue.

​

Remediation Modes

​

Filtering and Search

Quickly find specific remediations using these filter options:

​

Working with Remediations

​

Viewing Details

Click on any remediation card to open a detailed drawer with multiple tabs:

1. Details: Complete information about the remediation
2. Packages: List of affected packages and dependencies
3. Vulnerabilities: All vulnerabilities addressed by this remediation
4. Remediation Plan: Step-by-step plan for implementing the fix

​

Taking Action

From the remediation drawer, you can:

• Review proposed changes and fixes
• Access associated pull requests
• Monitor remediation progress
• View the complete list of vulnerabilities being resolved
• Follow the AI agent’s work in real-time from the Remediation Plan tab (for automated remediations)

​

Navigation

​

Understanding Priorities

Remediations are prioritized based on:

• Severity of vulnerabilities being addressed
• Number of affected systems
• SLA requirements

​

Pull Request Integration

When remediations generate pull requests, you’ll see:

• Direct links to PRs in your SCM platform
• Ability to review changes before merging

​

Terraform PRs for Cloud Misconfigurations

Backline automatically starts a supported Terraform remediation when all affected resources map to the same root in an onboarded repository and that mapping was confirmed by a recent state read or a previous repository selection. If Backline cannot confidently identify one root, the remediation stays in Hybrid mode. You can then start it manually by selecting the repository that manages the affected resources. To start a Terraform remediation manually:

1. Open the relevant Cloud misconfiguration remediation.
2. Go to the Remediation Playbook tab.
3. Click Open PR.
4. Select the Terraform repository that contains the configuration for the affected resource.
5. Click Open PR to start PR generation.

After the remediation starts, Backline will:

• Move the remediation to automated mode.
• Change the remediation status to In Progress.
• Start generating the Terraform pull request.
• Update the remediation summary.
• Show structured execution steps in the Remediation Plan tab.

For Terraform changes, Backline validates the configuration first and then attempts to verify the patch against every active Terraform deployment registered for the root when the remediation starts. A deployment is one state object and its execution settings.

• If every deployment produces a safe plan, the pull request can be marked ready.
• If an optional Terraform reader role or required plan input is unavailable, Backline opens a draft pull request pending human approval.
• If the plan proves that the patch is unsafe or breaks a root that previously planned, Backline rejects the patch.

AWS plan verification is opt-in. Azure findings and unsupported AWS roots can still produce draft pull requests pending human approval without running terraform plan. See Terraform Verification for AWS for the required roles and permissions, supported cases, and security details. The Open PR button is available only while the remediation is in Hybrid mode. Once Backline starts PR generation, the button is disabled. If you do not want Backline to open a Terraform PR, you can continue using the manual remediation or mitigation instructions in the Remediation Playbook.

​

Code Owners

During the remediation process, Backline’s AI agents automatically identify the most relevant code owners based on the scope of the remediation. This ensures the right people are notified and can take action on security fixes.

​

How Code Owner Identification Works

When a remediation is created, the agents analyze:

• Files affected by the vulnerability
• Recent contributors to the codebase
• Code ownership patterns
• Historical commit data

The system then lists the top owners identified for the remediation with confidence scores indicating how likely they are the right owners.

​

Automatic Assignment

​

Managing Code Owners

You can view and manage code owners directly from the remediation details:

​

Adding Owners Manually

If the AI agents didn’t identify any code owners, or if you need to add additional owners:

1. Open the Manage Owners screen from the remediation details
2. Click Add Owner or similar option
3. Enter the owner’s information (name, email, or username)
4. Save your changes

​

Code Owner Candidates

The management screen shows both:

• Assigned Owners: Currently responsible for this remediation
• Candidates: Other potential owners identified by the AI with their confidence scores

You can promote candidates to owners if they’re more appropriate for the specific remediation.