Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Remediation

Finding a risk is half the job — remediation is how it gets fixed. Mesh supports three complementary paths, from hands-on to fully automated.

Guided remediation in Mesh​

Every risk and profiling gap comes with context for resolving it. From an investigation, Mesh shows what the finding means and the step-by-step instructions to resolve it in the source system. See Investigate a risky identity for the end-to-end flow.

Delegation with direct user notification​

Often the person looking at a risk is not the person who can fix it. Delegation assigns the work to the right owner — for a single identity, or in bulk for every task in a view.

The assignee is notified directly: Mesh sends an email with the scope of the work, your notes, and a direct link that takes them straight to the relevant page with step-by-step resolution instructions. They do not need to know Mesh to receive the assignment — the notification carries everything needed to get started.

Automated external remediation through A2A agents​

For remediation that lives in another system, Mesh supports the open A2A (Agent2Agent) protocol. Administrators register external remediation agents with Mesh; the Mesh AI assistant can then discover and invoke them during an investigation — for example, asking an agent in your ITSM or access-management system to act on a finding.

Registered agents authenticate with the credentials your administrator configures, nothing is connected by default, and the full data-handling picture is described in AI features and data handling.

Prioritizing what to fix first​

Not every fix is worth the same. Mesh attaches a ranked list of remediation actions to an identity, finding, or asset, ordered by the loss exposure each one would buy down — so the action at the top of the list is the one that reduces the most dollars of risk, not just the most findings.

Each action names a concrete step — disable an account, rotate a credential, enforce MFA, remove a role, migrate an asset to quantum-safe cryptography, revoke an OAuth grant — against a specific subject, and carries the risk-score points and loss exposure it is predicted to remove. A remediation plan view narrows the list to the open work: the actions still proposed, accepted, or in progress.

Actions come from three places: a risk engine that recognizes a known fix, the Mesh AI assistant (which proposes actions for a person to approve), or a what-if scenario on the loss model. These surfaces help you decide and assign; the fix itself still happens through one of the three paths above.

How resolution shows up in Mesh​

Remediation happens in your source systems, so Mesh reflects it the way it learns everything else: through collection. After the responsible connector's next collection cycle, resolved risks clear and risk scores recalculate — remediating a risk lowers the score on a later cycle rather than instantly.