Security Factory

Factory, which makes the Droid coding agents, has opened a private preview of Security Factory, a product that tries to take a security finding all the way to a tested fix. Factory's argument is that finding vulnerabilities is no longer the bottleneck. Large engineering teams already run scanners, but checking whether each finding is real, working out its impact and coordinating a fix across code, dependencies and infrastructure is still mostly manual, so backlogs keep growing. Security Factory points Factory's existing agent tools at that gap.

The workflow has three stages. First, connectors pull findings from static-analysis, dependency, secret and infrastructure scanners together with context from threat intelligence, asset inventories, Jira tickets and Slack threads. Second, agents triage: they check whether vulnerable code is reachable, try to reproduce an exploit in an isolated sandbox and trace attack paths, meaning chains of weaknesses an attacker could combine. Factory's example is an internet-facing service with a known flaw that runs under an over-privileged account. Examined in isolation, the flaw's wider exposure can be missed, but tracing the path can show that compromising the service hands an attacker the account's credentials and, through them, sensitive systems. The result is meant to be a backlog ordered by demonstrated risk rather than by the severity a scanner assigns. Third, agents use that evidence to write a fix, which might be a code patch, a dependency upgrade, tighter permissions, a rotated credential or a configuration change, test it against the original exploit conditions, check for regressions and open a pull request.

Customers choose how far the agents go, from presenting a plan for human approval to creating pull requests and deploying fixes automatically within approved policies. Everything here is Factory's description of a product in private preview. The announcement gives no customer results, accuracy figures or examples of fixes produced, so how well the agents separate real risk from scanner noise is not yet shown.