Gartner’s How to Achieve the Minimum Viable AI Governance
Blog
AWS re:Inforce: Misconfigurations, Compliance and Security at Scale
Automation
Compliance
Most cybersecurity startups don’t go from napkin sketch to profitable business without a single dollar of outside funding. But then again, most startups aren’t led by Tal Kollender.
A self-taught hacker at 16, millionaire by 17, and military cybersecurity expert by 20, Tal’s journey from teenage prodigy to co-founder and CEO of Remedio reflects the evolution of cybersecurity itself from reactive damage control and mitigation to proactive, intelligent hardening.
Speaking at AWS Security Live, Tal shared her mission to solve one of the most stubborn, overlooked problems in cybersecurity: misconfigurations.
Misconfigurations: The Risks Hiding in Plain Sight
Misconfigurations occur when systems, devices, or applications are set up or operated in ways that needlessly expose them to risk. Unlike vulnerabilities, these issues are not a mater of design but deployment. They include default credentials, excessive permissions, dangerous port use, and broken policy enforcement mechanisms.
Currently, security teams invest considerably more attention in dealing with vulnerabilities than they do with misconfigurations. But that doesn't mean it's the lesser threat. In fact, the data tells a very different story, with 1 in every 3 security incidents stemming from a misconfiguration. That figure rises to 80% when it comes to ransomware attacks. Worse still, misconfigurations make virtually all breaches worse, allowing attackers to go deeper and further via lateral movement.
This begs the obvious question: why is such a pernicious source of exposure treated as a secondary security threat? The answer is less obvious, but it surely has something to do with how difficult misconfigurations can be to define, detect, deal with, and definitively prevent from recurring.
Of course, that whole equation changes if you can introduce new levers of control and make it easier for operators to reliably effectuate change. And that's exactly what Tal Kollender is doing.
When it comes to misconfigurations, “Detection isn’t enough,” Tal explains. “You need to fix problems, safely and at scale, without breaking the business.”
That last part is crucial and not always so clear cut. A tweak meant to improve security can just as easily disrupt a business-critical process if dependencies are well mapped and understood. In large enterprises, with thousands of assets interconnected through a network and stack built out in a decades-long patchwork, the fear of unintended operational consequences often leads to inaction.
Bridging Compliance and Security with Real-World Automation
But risk-aware automation isn’t just about safe remediation, it’s also the missing link between security and compliance. When teams can remediate confidently, without fear of breaking things, they can move beyond reactive firefighting and start building toward consistent, enforceable standards (i.e. fireproofing). That’s where compliance enters the picture, not as a bureaucratic hurdle, but as a natural byproduct of doing security right.
For years, compliance has been labeled the boring corner of security: checklists, audit reports, and governance meetings. But actually, according to Tal, “Compliance isn’t dry when it’s actionable, measurable, and integrated into daily security operations.”
Remedio closes the long-standing gap between security posture and compliance frameworks. Whether it’s CIS benchmarks, HIPAA, PCI, or a custom framework, the platform maps detected risks and available remediations to compliance requirements, giving teams a real-time, actionable view of where they stand and how to improve.
It's important to remember though that compliance should not itself be treated as the endgame. It's part of a larger picture and goal. “Compliance should never be a checkbox exercise,” Tal explains. “It should be an outcome of doing security right: consistently, safely, and at scale.”
To that end, Remedio allows organizations to create their own custom baselines, tailoring compliance enforcement to business reality. And it's in that tailoring, predicated on context-awareness, both technologically and operationally, that tremendous functional value is unlocked.
But even the most thoughtfully designed compliance program falls short if it can’t scale. Standards, policies, and remediation playbooks are only as effective as an organization’s ability to apply them: consistently, across thousands of endpoints, environments, and edge cases.
And that's where most traditional approaches to security hygiene begin to crack under pressure.
Why Scale Breaks Traditional Security Hygiene
What works in a 500-user environment rarely works in a 500,000-user one. Tal describes it bluntly: “You can’t rely on best-effort scripts or manual audits when you’ve got tens of thousands of assets to secure.”
Remedio takes a continuous, context-aware, and automated approach, comparing policies, current device states, and applicable compliance standards to identify safe hardening opportunities.
And when hardening is required but poses operational risks, Remedio makes it clear exactly where the required remediation interferes with core functionality, easing the path to operational disentanglement or circumstantial risk acceptance and mitigation.
Now, suppose you throw caution to the wind and push potentially disruptive changes without taking any precautions. You may well live to regret that decision. But even in that case, Tal has you covered with a click-to-rollback safeguard that ensures every action can be reversed.
And with Remedio's continuous monitoring, you can be sure that if anything drifts, falls out of compliance, or becomes subject to a new risk, you'll not only know about it, but you'll be put in position to act.
Built Differently
Led by Tal, a woman CEO in an industry that’s still overwhelmingly male, perhaps we shouldn't be surprised that Remedio’s journey defies convention. It’s bootstrapped. It’s profitable. It’s led by a woman CEO in an industry that’s still overwhelmingly male. And it’s growing fast, with over $10 million in ARR and global enterprise customers.
Looking ahead, the company is expanding into patch and vulnerability management, an area Tal believes is still broken.
“Patch and vulnerability management are treated like separate systems. They’re not integrated, they’re not prioritized, and they’re not safe,” she explains. “We’re building something that changes that, just like we did with configurations.”
It’s all part of Remedio's next phase: becoming the go-to platform for safe, autonomous security hygiene across the modern enterprise. Stay tuned.
FAQ
Why are misconfigurations still one of the biggest enterprise security risks?
Misconfigurations are introduced through routine operational changes and often remain unnoticed for long periods. Unlike software vulnerabilities that require a vendor patch, configuration weaknesses already exist inside the environment and can expose excessive permissions, insecure services, or weak policies that attackers readily exploit. Preventing them requires continuous validation rather than one-time hardening.
Why isn't vulnerability detection enough to reduce cyber risk?
Detection identifies problems but does not remove exposure. Organizations only reduce risk when findings are safely remediated and validated. The operational challenge of making changes across thousands of systems often creates a backlog that leaves known risks exposed long after they have been discovered.
How can organizations automate security remediation without risking outages?
Safe remediation depends on understanding device context, validating proposed changes before execution, and providing rollback if unexpected issues occur. Automation should reduce operational risk, not increase it, allowing security teams to implement changes confidently across large environments.
What is the relationship between compliance and configuration security?
Strong configuration management naturally improves compliance because many regulatory frameworks require secure system settings and continuous enforcement. Rather than treating compliance as a separate reporting exercise, organizations achieve better results when secure configurations are continuously maintained and verified.
Why do traditional security practices struggle at enterprise scale?
Manual audits, scripts, and periodic reviews cannot keep pace with environments containing tens or hundreds of thousands of endpoints. Enterprise-scale security requires continuous monitoring, automated policy enforcement, and the ability to correct configuration drift as infrastructure changes.
What is configuration drift, and why does it matter?
Configuration drift occurs when systems gradually diverge from approved security baselines because of updates, administrative changes, software installations, or operational exceptions. Left unchecked, drift creates inconsistent security controls, increases attack surface, and makes compliance harder to maintain.
How does continuous configuration monitoring improve security?
Continuous monitoring detects unauthorized or unexpected configuration changes as they occur instead of waiting for scheduled audits. This allows security and IT teams to identify new exposure quickly, restore approved configurations, and maintain a consistent security posture over time.
Why is rollback important in automated security operations?
Even carefully planned security changes can have unintended operational consequences. Automated rollback provides a safety mechanism that allows organizations to reverse changes quickly if business-critical functionality is affected, making teams more willing to remediate risk instead of delaying action.
About Author
