Re-Grade Cloud Findings With AI Agents to Fix Static Severity Errors

Security teams relying on static severity scores from cloud platforms are likely misprioritizing their remediation efforts. According to Help Net Security, research by Sola Security indicates that vendor-provided severity levels often fail to reflect the actual risk within a specific production environment. The study highlights a significant gap between general rule definitions and the specific conditions of deployed resources.

The risk

Cloud security platforms generate findings based on failed rules, assigning a severity level that remains constant regardless of the environment. Sola Security researchers Leon Goldberg and Gal Engelberg built an AI agent to re-evaluate these findings by checking them against the actual environment. The agent processed 9,967 high-severity findings from two commercial platforms across eight production environments. It changed the severity grade for 75.1 percent of the findings. Of those changes, 58.5 percent were downgraded, while 16.6 percent were upgraded to a higher severity.

The researchers noted that static severity reflects the general risk of a condition, not the specific deployment. A rule author encodes context once for every environment, but the deciding factors for a specific instance lie elsewhere. This includes whether the flagged resource is attached to other systems or if a workload is actively running on it. Scoring standards like CVSS include environmental metrics to adjust base scores, and NIST guidance ties likelihood to existing controls. The researchers observed that static severity leaves this contextual adjustment empty.

Who is exposed

Organizations using third-party cloud security platforms are affected by this discrepancy. The Sola Security study focused on findings from two commercial platforms in production environments. The AI agent analyzed each finding by forming a theory of exploitation and collecting evidence from resource configurations, connected resources, and other security products. The agent’s policy required more evidence to raise a severity than to lower it. Lowering a grade required an observed property that offset the exploitation path, while raising it required evidence of increased risk or missing guardrails like firewalls.

Cost and compliance

The study identified six recurring patterns where cloud APIs could verify deciding facts. The largest pattern, accounting for 32.3 percent of findings, involved inert resources that were orphaned or attached to nothing. Other downgrades occurred for resources unreachable from the internet, those missing live services, or those with narrow source restrictions. Account-level blocks also contributed to severity reductions. The source material does not detail specific financial costs or compliance penalties associated with these misgraded findings, only the statistical prevalence of the inaccuracies.

Our take on the response

Security managers should recognize that vendor severity scores are generalizations that may not apply to specific resource states. Integrating contextual analysis can prevent teams from wasting effort on low-risk items while potentially missing higher-risk configurations. That suggests a shift toward dynamic risk assessment rather than relying solely on static rule outputs for prioritization.

What to do and how to stay safe: Sola Security

• Review high-severity findings to determine if the affected resources are currently active or connected to critical workloads.
• Implement automated checks that verify network reachability and service status before assigning high priority to cloud security alerts.
• Evaluate whether existing controls, such as firewalls or account-level blocks, mitigate the risk described in the finding.
• Monitor for patterns where static severity scores consistently mismatch the actual environment context, and adjust internal prioritization workflows accordingly.

Step-by-step guide: Cloud Logging and Monitoring Best Practices for Detection

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many findings were downgraded in the Sola Security study?

The AI agent downgraded 58.5 percent of the 9,967 high-severity findings it analyzed.

What criteria did the AI agent use to change severity scores?

It collected evidence from resource configurations, connected resources, and other security products to determine if the condition was worse or better in that specific environment.

What was the most common reason for a severity downgrade?

The most common reason was inert resources, such as those that were orphaned or attached to nothing, accounting for 32.3 percent of findings.