When to run it
A completed external pentest or red-team report, a retest date on the calendar, and engineering teams who need to fix findings without dropping roadmap work.
The pentest is done.Now the findings close.
Turning a pentest report into merged fixes
The playbook in one paragraph
A penetration test lands as a PDF with dozens of findings. Ana parses it, confirms which findings are reachable in your code and cloud, writes the fixes with regression tests, and hands the auditor evidence for every closure.
Works with
- The pentest report (PDF, CSV or platform export)
- Repositories and CI
- Cloud accounts (read-only to start)
- Ticketing: Jira or Linear
What Ana needs from you
- Report and scope
- Retest date
- Risk acceptance policy for findings you will not fix
How Ana runs it
Step by step.
5 steps from trigger to done - each one visible to your team as it happens.
- 01
Parse and normalize
Ana extracts every finding - endpoint, payload, evidence, severity - and turns it into a structured ticket linked to the code and infrastructure it touches.
- 02
Confirm reachability
Ana traces each finding to the code path, configuration or IAM policy responsible and checks whether it is reachable as deployed, so effort goes where exposure is real.
- 03
Write the fix
For each confirmed finding Ana writes the patch - input validation, authorization check, header, policy change - plus a regression test that reproduces the original attack.
- 04
Route for approval
Fix PRs go to the owning team; infrastructure and IAM changes go through your policy gates to named approvers.
- 05
Package the evidence
Each closure gets a record: the finding, root cause, the change, the test that proves it, and who approved it - ready for the retest and your auditor.
Who approves what
Approval gates
- Code fixes
- Owning team review
- IAM and network changes
- Named security approver
- Risk acceptance
- Security lead, recorded with rationale
What you get
Deliverables
- 01Patch PRs with attack-reproducing regression tests
- 02A reachability-ranked finding list
- 03Closure evidence per finding for the retest and audit
What usually goes wrong
And how Ana handles it.
Risk
Fixing the reported endpoint but not the pattern
Ana searches for the same vulnerable pattern elsewhere in the codebase and fixes the siblings too.
Risk
Fixes that break functionality
Every fix runs the full test suite in CI, not just the new regression test.
FAQ
Common questions.
No. It starts read-only on code and cloud configuration; changes go through your PRs and pipelines.
Keep going
Related playbooks.
Security
Clearing a dependency CVE backlog
Your SCA tool reports thousands of vulnerable dependencies and the number never goes down. Ana works out which are actually reachable, upgrades them safely with tests, and documents why the rest can wait.
Read the playbook →Security
Fixing cloud misconfigurations at the source
Your CSPM tool flags public buckets, wide IAM policies and open security groups. Ana traces each one back to the infrastructure-as-code that created it, fixes it there, and stops it from coming back.
Read the playbook →Software
Upgrading a framework across dozens of services
A major framework or runtime version is going end-of-life and it touches every service. Ana plans the migration, upgrades each service in its own branch, fixes what breaks, and hands your team small, tested pull requests instead of one terrifying diff.
Read the playbook →See it in your stack
Run this playbook on your systems.
Thirty minutes, your repositories and cloud, one real instance of this job.