Berlin-based security vendor Mondoo wants to end the endless red lists. At it-sa, its team explained how AI agents prepare fixes, roll them out via tools such as Intune and CrowdStrike, and verify the result, with humans deciding how much autonomy to grant.
Most security tools describe problems, few remove them. Mondoo, a Berlin-based provider of exposure management, wants to change that with agentic remediation: the platform finds vulnerabilities and misconfigurations, prioritizes them, prepares the fix and checks whether the risk is actually gone. At it-sa 2026 in Nuremberg, Mondoo CTO Christoph Hartmann and CISO Patrick Münch explained to Security Storage und Channel Germany how this works in practice.
From finding to fixing
The starting point is a familiar one. According to Mondoo, most security vendors deliver problems rather than solutions: long lists of findings that overstretch IT teams. The pressure is growing. The Forum of Incident Response and Security Teams (FIRST) expects around 66,000 new CVEs in 2026, more than 180 per day, while AI agents and AI-generated code change IT environments faster than security teams can map them.
Mondoo describes its answer as a chain. The platform discovers weaknesses, prioritizes them and then remediates them, across on-premises systems, SaaS and cloud. A workflow engine creates tickets automatically and applies the fix on the target system. On a notebook managed through Microsoft Intune, the fix is delivered and the issue resolved within a few minutes, the company says. Remediation is now also integrated into mobile device management with Baramundi and into CrowdStrike. Teams set policies that decide where the AI acts on its own and where it waits for human approval. After the rollout, the platform verifies that the risk has actually been removed, the company stresses, instead of closing a ticket on the assumption that the fix worked.
Licensing follows the use case: per device for infrastructure and endpoints, per developer for source code. The new source code inspection delivers fixes as GitHub pull requests, in the IDE or via coding agents, as announced on 20 October. Further additions include scans of the external attack surface, which check internet-facing hosts for TLS, DNS, HTTP and email security issues, and an expanded range of fixes for CIS Benchmarks, tested on a real system where suitable and confirmed by a renewed scan. Customers’ own AI agents can also work with Mondoo via the Model Context Protocol (MCP), query exposures and trigger fixes within existing workflows.
Open source, compliance and AI agents
Mondoo builds on open source. The tools cnquery and cnspec and the source code on GitHub are meant to create transparency, with the commercial platform built on top. Through policy as code, systems are meant to stay hardened: if a configuration drifts, Mondoo corrects the deviation again, according to the company.
For compliance, the product ships with policies for the security configuration of Windows and Linux systems. An internal mapping to ISO 27001 and DORA is intended to automate the technical evidence, so that auditors can rely on current data rather than an annual sample. The vendor also says it is in communication with authorities.
A second field is the security of AI agents themselves. Mondoo says it can determine where AI agents run in a company’s environment and which skills they use. A skill scanner is part of the platform, and a skill checker is available on the company’s website. Organizations can define in the platform what is permitted on devices. Security, as Mondoo sees it, should create transparency rather than block adoption. The goal is for governance to capture all agents, since risks are often accepted at the edge of what is tolerable. The question of how much to hand over to AI is also the subject of a CISO circle with about ten participants, including a workshop on a human-out-of-the-loop approach to exposure management and the SOC.
Roadmap: away from red lists
Mondoo wants to move further away from red lists. Next up is remediation for servers, where patching is more complex. Security assessment, configuration and maintenance windows have to be coordinated, and different people pursue conflicting goals. The planned answer is native integration into existing IT processes.
Customers and partners
Mondoo has been a GmbH in Berlin since 2020 and employs about 40 people worldwide. Reference customers include Deutsche Telekom, Edeka, BFA and Volksbank Frankfurt, with several thousand seats in use. With Telekom, Mondoo offers a joint service on a sovereign cloud. For 2027, the plan is to scale this further and to support digital sovereignty.
Sales run through partners such as SVA, Cancom and smaller boutique providers. Mondoo counts 12 partners in the DACH region and 11 in the rest of the world. The company intends to expand this network and hire additional staff. Customers can run the functions on the platform themselves or have Mondoo deliver them as a service through the Agentic Managed Vulnerability Service, an option that also suits system integrators and managed service providers.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de
My office setup shows issues that manual fixes often overlook. Automation handles those subtle drifts better than staff can.