Automated Cybersecurity Remediation Platform
Open-Source Cybersecurity Engineering | Version 1.0.0
An independently developed cybersecurity automation platform designed to connect security assessment, risk contextualisation, controlled remediation and independent verification.
The project demonstrates practical expertise in Python development, Linux systems administration, networking, vulnerability management, database engineering, automation and secure systems integration.
Project status: Public v1.0.0 source-code baseline — pre-production.
Project Overview
Security scanners can identify vulnerabilities and configuration weaknesses, but detecting an issue does not necessarily mean it will be resolved.
This project explores how security findings can be processed through a structured, auditable remediation workflow while maintaining deterministic decision-making, appropriate authorisation and independent verification.
The platform brings together multiple security technologies into a modular architecture designed to:
- Collect and normalise findings from different security assessment tools.
- Apply consistent finding classifications and contextual risk analysis.
- Select remediation capabilities through deterministic rules.
- Execute authorised remediation actions using Ansible.
- Verify whether remediation was applied and whether the originating security finding remains.
Architecture and Technologies
The platform integrates several complementary technologies.
Security assessment: OpenVAS, Wazuh, Nmap NSE, Nuclei, Lynis and Trivy.
Application development: Python, structured JSON processing and scanner-specific orchestration.
Infrastructure: Ubuntu Linux, Docker, PostgreSQL and Redis/RQ.
Risk contextualisation: Ollama for AI-assisted analysis.
Remediation: PostgreSQL-backed routing rules, remediation controllers and Ansible Runner.
Workflow orchestration: n8n integration architecture and approval-aware execution controls.
Verification: Local remediation checks, originating-scanner verification and deferred verification for supported asynchronous scanner workflows.
Unified Security Finding Architecture
Scanner-specific orchestrators interpret native security results, determine finding classes and transform findings into a common data structure.
The Unified Security Finding schema allows different scanning engines to participate in a consistent workflow while retaining scanner-specific evidence.
The platform maintains a controlled catalogue of 43 finding classes.
Deterministic Remediation
AI-generated analysis is advisory rather than authoritative.
Ollama contributes risk context and explanatory information, while scanner-specific logic and PostgreSQL rules govern finding classification and remediation routing.
The architecture separates AI enrichment from security-critical remediation decisions.
Seven Remediation Capabilities
The remediation architecture defines seven capabilities:
- Operating-system patching
- Container image remediation
- CIS and host hardening
- Service configuration
- Web application remediation
- File integrity remediation
- Security incident response
These capabilities provide a structured interface for Ansible-based remediation. Individual integrations have different levels of implementation and validation.
Independent Two-Stage Verification
A central engineering principle of the project is that successful execution does not automatically establish successful remediation.
Stage 1 — Execution verification
Checks whether the remediation action was executed successfully and whether the expected local change was applied.
Stage 2 — Security finding verification
Where supported, uses evidence from the originating security scanner to determine whether the finding remains present.
The platform also supports deferred verification for selected asynchronous scanner workflows, including Wazuh SCA.
When authoritative verification evidence is unavailable, the system must not assume that remediation succeeded.
Engineering, Testing and Validation
The project includes automated regression tests, release smoke tests and selected live remediation integration tests.
Development and validation activities include:
- Scanner output normalisation and deterministic classification.
- PostgreSQL schema management and version-controlled migrations.
- Ansible-based remediation execution.
- Authentication and execution-target safeguards.
- Scan coordination and lease management.
- Two-stage remediation verification.
- Isolated database installation and release packaging validation.
- Failure-handling and recovery testing.
Fresh PostgreSQL installation, release preparation and offline provisioning have been validated in disposable environments.
These results establish evidence for selected engineering workflows, not complete production readiness across every supported scanner and remediation capability.
Professional Skills Demonstrated
This project provides evidence of practical work across several technical disciplines.
Python programming: Developing orchestrators, structured data processing, automation services and integration logic.
Linux administration: Working with Ubuntu, system services, security tools, configuration and deployment environments.
Networking: Understanding host discovery, network services, scanning protocols and secure service communication.
Cybersecurity: Vulnerability assessment, compliance drift, remediation controls and independent verification.
Database engineering: Designing PostgreSQL-backed workflows, audit records, migrations and state management.
DevSecOps and automation: Integrating GitHub, automated testing, Ansible, containers and controlled release processes.
Connection to IT and Cybersecurity Training
The platform provides a practical technical foundation for developing demonstrations, case studies and isolated training laboratories.
Relevant teaching subjects include networking fundamentals, Linux administration, vulnerability assessment, Python scripting, security automation and remediation verification.
Training exercises can be designed around controlled environments and synthetic security findings without requiring access to production infrastructure.
Project Status and Limitations
Version 1.0.0 establishes a documented, versioned public software baseline.
The project remains pre-production. Not every scanner integration or remediation capability has completed full operational acceptance testing.
Wazuh File Integrity Monitoring and Rootcheck orchestrators remain to be implemented. Full production deployment also requires environment-specific configuration, security controls and further operational validation.
The repository is available publicly under the Apache License 2.0 for source-code review, technical evaluation and contributions.
Explore the Project
GitHub repository:
https://github.com/reg-kin/automated-cybersecurity-remediation-platform
Version 1.0.0 release:
https://github.com/reg-kin/automated-cybersecurity-remediation-platform/releases/tag/v1.0.0
Interested in practical IT and cybersecurity training?
Contact Regis Security Consulting to discuss instructor-led training, technical workshops and tailored learning materials.