Make changes safely, under your policy, and prove they worked
Your agents, and soon ours, deploy the mitigation or apply the fix. The policy gate decides every action, and nothing is marked done until the path is verified closed.
Every action passes your policy gate
- In scope? else denied
- Allowed kind of action? else denied
- Within the safety floors? else denied
- Within your limits? else denied
- Pre-approved? else a person approves
A policy you write
Your team or your agent sets it. Defendermate applies it to every action.
Scope
Accounts, environments and resources in bounds.
Never allowed
Actions that must never run, like deleting resources.
Pre-approved
Actions that can run without a person approving each one.
Limits
How much can change, how fast, and when.
Safety floors
Rules no policy can switch off.
Two kinds of change
Run directly after approval, as a pull request through your pipeline, or as a ticket your agent opens in Jira or ServiceNow.
Deploy a mitigation
As code (Terraform, Ansible or Sigma), written in your team’s own conventions.
Apply an available fix
A package upgrade, a version-bump pull request or a patched image, in the order Plan worked out.
Done means verified
Apply
The approved change runs, or merges through your pipeline.
Re-verify
The same checks that found the exposure run again.
Roll back if it failed
The exposure stays open for another option.
Retire the mitigation
Once the fix is verified, the temporary control comes off.
Defendermate applies fixes that vendors and maintainers have released. It never writes the upstream patch, and works alongside your code-fix tools.
Close exposures and prove it
Every change waits for your policy.