Mondoo adds agentic remediation with Intune and CrowdStrike integrations

Mondoo says its platform now finds, fixes and verifies security exposures autonomously, deploying patches through Microsoft Intune and CrowdStrike Falcon.

By The Datatech Times Editorial Team AI level 2 of 5
AI level 2 of 5: drafted by our AI editorial assistant from the company's announcement; fact-checked, edited and signed off by Mark Walker, Editorial Director. What the levels mean
A dark grey rack-mountable network device featuring a row of white status lights, six labeled BNC connectors with active green and blue LEDs, eight RJ45 Ethernet ports with green link lights, and a USB port, resting on a reflective light gr

Mondoo has expanded its exposure management platform with what it describes as agentic remediation: a set of capabilities designed not merely to surface vulnerabilities but to build and deploy fixes through tooling security teams already operate. The San Francisco-based company says the new features cover source code, external attack surfaces, cloud and infrastructure, and endpoints, with integrations into Microsoft Intune and CrowdStrike Falcon for automated patch delivery.

The company says it has performed more than five million remediations for more than 300 customers to date. It did not disclose revenue, ARR or named enterprise customers in the release.

What the platform now does

The expanded feature set has four main components. Code inspection and remediation scans repositories for vulnerable dependencies, misconfigurations and exposed secrets, then surfaces fixes as GitHub pull requests, IDE suggestions or inputs to coding agents. The platform subsequently re-analyses the revised code to confirm the risk is closed, a verify step the company positions as differentiating from scan-only tools.

External attack surface scanning checks internet-facing hosts for TLS, DNS, HTTP and email security weaknesses, with continuous monitoring to confirm findings stay resolved after remediation. Enhanced CIS Benchmark remediations extend the range of automated fixes for supported benchmark checks, including systems already in production; Mondoo says it tests each remediation on a live system and re-scans to confirm the control passes.

The agentic logic allows teams to set policies governing how much autonomy the platform exercises: routine low-risk fixes can run without human approval, while changes to sensitive systems wait for sign-off. A policy-as-code layer is intended to prevent configuration drift after a fix is applied, and the platform exposes an MCP (Model Context Protocol) endpoint so customers' own AI agents can query exposure data and trigger fixes inside existing workflows.

Chief executive Soo Choi framed the launch against a wider market frustration: "Security teams expect more from AI than another dashboard of findings. They want it to do the work for them, and do it intelligently. Most vendors tell you what to remediate. Mondoo does the remediation for you."

Market context

The vulnerability management market is under pressure from two directions simultaneously. FIRST, the Forum of Incident Response and Security Teams, forecasts roughly 66,000 new CVEs in 2026, exceeding 180 per day. At the same time, AI-generated code and autonomous software agents are enlarging attack surfaces faster than manual triage processes can track them.

This has created space for a new category that vendors variously call exposure management, automated remediation or agentic security. Mondoo competes in a crowded field: Tenable, Qualys and Rapid7 dominate legacy vulnerability management; Wiz, Orca Security and Lacework address cloud-native posture; and a number of better-funded startups are building remediation workflows on top of existing scanner outputs. What distinguishes Mondoo's positioning is the emphasis on closed-loop verification and the lean on existing endpoint management channels (Intune, CrowdStrike) rather than deploying a proprietary agent.

The integration with CrowdStrike Falcon is commercially notable given CrowdStrike's market penetration in enterprise endpoint detection and response. Building on that distribution channel reduces the friction of selling to security operations teams that have already standardised on Falcon.

Regulatory read-across

Automated remediation sits at the boundary of several compliance frameworks. SOC 2 and ISO 27001 auditors expect change-management controls around any automated system that modifies production environments; Mondoo's human-in-the-loop policy layer is likely designed in part to satisfy these requirements. The platform's on-demand evidence export is positioned explicitly for compliance and audit use cases, which will matter to customers in financial services and critical national infrastructure operating under DORA or NIS2 obligations in Europe.

Mondoo is demonstrating the new capabilities at it-sa 2026 in Nuremberg from 27 to 29 October. The features are available immediately both as a self-operated platform and as a managed service delivered under the company's Agentic Managed Vulnerability Service offering.

Sector

Topic

Geography