--- title: "Control and Remediation Verification | Clearly AI" description: "Verify that the mitigations and controls called for in a security review were actually built, with evidence from code, IaC, policies, and security tools, and residual risk updated on the threat model." canonical: https://clearly-ai.com/platform/control-and-remediation-verification --- _Control and remediation verification_ # Verify what actually shipped Clearly AI checks whether the mitigations a threat model calls for were built, and whether each product meets your baseline security controls. It reads code and infrastructure as code, pulls evidence from your policies and security tools, and links every result to the evidence behind it. - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [Read the docs](https://docs.clearly-ai.com/docs/risk-registry) - Ericsson - PayPal - Modern Health - Hagerty - Rivian - Infineon - Bastion ## Did the fix ship, or just the ticket? Most security reviews end at the design stage. The threat model calls for input validation, encryption at rest, or a scoped IAM role, and a ticket goes to engineering. When the ticket closes, the risk is marked resolved, and often no one checks the code to see what was built. Verifying it by hand means reviewing the pull requests and deployments, one finding at a time. Most teams don't have the time, so the threat model keeps describing the design instead of the system that shipped. Baseline controls have the same gap across every product. Your policies require encryption at rest, SSO, logging, and least-privilege access, but confirming that means chasing engineers for screenshots, reading Terraform files, and cross-referencing scanner findings. When an auditor asks for evidence, the team rebuilds it after the fact. ## Two kinds of verification, one platform - **Remediation verification:** Starts from a threat or risk. Confirms the mitigation was built, then updates residual risk on the threat model and in the risk registry. [Jump to remediation verification](https://clearly-ai.com/platform/control-and-remediation-verification#remediation) - **Control verification:** Starts from your control baseline. Confirms each required control is in place for a product, with evidence attached to every control. [Jump to control verification](https://clearly-ai.com/platform/control-and-remediation-verification#controls) _Remediation verification_ ## Verify the mitigation, then update the risk A threat found at design review stays open until the code shows it's handled. Clearly AI compares what the threat model called for with what was built, then recalculates residual risk. 01. **Design.** **Start from the design-stage threat model:** Threats and required mitigations identified during design review carry forward, each with its severity and owner from the risk registry. Threat · TM-07 (High): **Unauthenticated access to admin API**. Required mitigation: Enforce OIDC auth on `/admin/`. Owner: Priya Shah 02. **Code.** **Rebuild it from the code:** When the implementation is ready, Clearly AI regenerates the threat model from the repository and infrastructure as code. acme/payments-api (main): - `src/admin/routes.ts` - `src/middleware/auth.ts` - `payments-api/main.tf` (IaC) - `payments-api/iam.tf` (IaC) - `payments-api/outputs.tf` (IaC) 03. **Mitigation.** **Find the mitigation:** Clearly AI reads the code to determine whether each required mitigation was built, where it lives, and whether it covers the threat as designed. `src/admin/routes.ts` ``` 11 const admin = Router(); 12 admin.use(requireOidcAuth()); 13 admin.get('/users', listUsers); 14 admin.post('/refunds', refund); 15 export default admin; ``` Mitigation found (TM-07) 04. **Residual risk.** **Update residual risk:** Each threat is marked mitigated, partially mitigated, or open. Residual risk is recalculated from the mitigations that were built and synced to the linked risk in the registry. Threat · TM-07 (Low): **Unauthenticated access to admin API**. Required mitigation: Enforce OIDC auth on `/admin/`. Inherent: High → Residual: Low ### Mitigations read directly from code and IaC Clearly AI reads the implementation to decide whether a threat is mitigated, so no one has to chase the engineer for an answer. - **Application code:** Authentication and authorization checks, input validation, encryption calls, secrets handling, and logging, found in the code paths the threat applies to. - **Infrastructure as code:** Network exposure, IAM policies, encryption settings, and storage configuration, in any IaC format, including Terraform, CloudFormation, Kubernetes manifests, Helm, and Pulumi. - **Pinned to a specific commit:** Each verdict references the repository, file, and commit it was checked against. - **Gaps called out:** When a mitigation is missing, incomplete, or applied to only part of the system, Clearly AI flags it with the location and what's missing. ### Residual risk that reflects what you built - **Design to code, in one record:** The threat identified at design and the mitigation found in code appear on the same threat, so the history of the decision stays together. - **Residual risk recalculated:** Threats with verified mitigations drop to their residual severity. Threats without them stay open at their original severity. - **Registry stays current:** Updated residual risk flows to the linked risks in the risk registry, so owners and SLAs reflect the system as built. - [See the risk registry](https://clearly-ai.com/platform/resolve/risk-registry) - [See how Clearly AI detects drift between design and code](https://clearly-ai.com/solutions/continuous-threat-modeling) _Control verification_ ## Verify your baseline controls on every product Clearly AI evaluates each product against the security controls your organization requires, from your own policies, standards, and control frameworks. Every control gets a result and the evidence behind it. 01. **Load your control baseline.** Upload a policy or control spreadsheet, or start from a framework. Clearly AI turns it into a review template within hours. 02. **Scope it to the product.** Clearly AI applies the controls that fit the product under review, based on its architecture, data, and deployment. 03. **Gather evidence for each control.** Clearly AI collects evidence from the code and IaC, your policies, connected security tools, and screenshots or links your team provides. 04. **Report the result.** Each control is marked compliant, partially compliant, noncompliant, missing info, or not applicable, with the supporting evidence attached. Publish any noncompliant or partially compliant control to the risk registry with an owner and due date. ### Evidence from every source your controls live in Not every control lives in a repository. Clearly AI accepts the evidence types security, GRC, and audit teams already rely on, and evaluates each one against the control it supports. | Evidence source | What Clearly AI checks | | --- | --- | | Code and IaC | The control as implemented, read directly from the repository or infrastructure templates, in any IaC format. | | Policies and standards | Whether a documented policy, standard, or procedure covers the control requirement. | | Security tools | Posture and vulnerability findings from connected tools like Wiz and Snyk, used to confirm a control is configured or to surface where it isn't. | | Screenshots and links | Uploaded screenshots of configuration screens and console views, and URLs to pages your team points to, read for the setting or attestation the control requires. | Every piece of evidence is attached to the control it supports, with its source and the date it was collected. [See the integrations Clearly AI supports](https://clearly-ai.com/integrations) ### One baseline, applied the same way to every product - **Your control set:** Controls come from your own policies, standards, and frameworks. - **Consistent across products:** The same versioned template runs on every product, so results are comparable across the portfolio. - **Gaps become tracked risks:** Publish noncompliant and partially compliant controls to the risk registry with an owner, severity, and SLA. - **Missing info flagged:** When the evidence isn't there, the control is marked missing info, so your team knows exactly what to ask for. [See how product security teams check every product against policy](https://clearly-ai.com/solutions/product-security-assurance) _Audit-ready_ ## Verification your team can trust Both kinds of verification show their work, so a reviewer can check any result before approving it. - **Traceable to source:** Each result links to the file and line, tool finding, policy section, screenshot, or link behind it. - **Reviewer in the loop:** Security engineers confirm, override, or request more evidence, and every decision is recorded with who made it and when. - **Versioned and exportable:** Results are tied to the template version and project state they ran against, and export with their evidence for audits and regulator requests. [See how Clearly AI keeps findings accurate and traceable](https://clearly-ai.com/platform/quality) ## Coverage that holds up after the review - **~90%** Reduction in time per review - **4x** Review capacity with the same headcount - **From 10 to 100%** Product coverage > “Weeks to minutes, literally.” > > — William Brown, Sr. Director of Product Security and Privacy [Read customer stories](https://clearly-ai.com/customer-stories/hid-global) _FAQ_ ## Answers to your top questions ### What is remediation verification? Remediation verification is confirming that a fix for a security finding was implemented, rather than relying on a closed ticket. Clearly AI regenerates the threat model from the code and infrastructure as code, confirms which mitigations were built, and links each result to its source. ### What is control verification? Control verification is confirming that a product meets the security controls your organization requires, such as encryption at rest, SSO, audit logging, and vulnerability management. Clearly AI evaluates each control against your policies and frameworks, marks it compliant, partially compliant, noncompliant, missing info, or not applicable, and attaches the evidence for every result. ### What's the difference between remediation verification and control verification? Remediation verification starts from a specific threat or risk and confirms the mitigation for it was built, then updates residual risk. Control verification starts from your baseline security controls and confirms each one is in place for a product. Clearly AI does both, using the same evidence sources and audit trail. ### How does Clearly AI know a threat is mitigated? Clearly AI reads the application code and infrastructure as code, in any IaC format, for the system under review and looks for the mitigation the threat model requires, such as an authentication check, an encryption setting, or a scoped IAM policy. It records where the mitigation lives and flags any part of the system it doesn't cover. ### How does residual risk get updated? When a threat model created at design is regenerated from the code, Clearly AI compares the planned mitigations with what was built. Threats with verified mitigations are lowered to their residual severity, and the linked risks in the risk registry are updated. [See how risks are tracked in the risk registry](https://clearly-ai.com/platform/resolve/risk-registry) ### Can control gaps be tracked as risks? Yes. Publish any noncompliant or partially compliant control to the risk registry, where it gets an owner, a severity, and an SLA due date. ### What types of evidence can Clearly AI use to verify a control? Code and infrastructure as code, policies and standards, findings from connected security tools like Wiz and Snyk, uploaded screenshots, and links to pages your team provides. Each piece of evidence is attached to the control it supports. ### Can we use our own control framework? Yes. Upload a policy or control spreadsheet and Clearly AI turns it into a review template in hours. The same versioned template runs on every product. ### Does Clearly AI integrate with Wiz? Yes. Clearly AI imports Wiz projects and posture findings and uses them as evidence when verifying cloud controls. See the Wiz integration ### Is this continuous monitoring? No. Clearly AI verifies mitigations and controls when a review runs, such as when a product is assessed or a release is ready. It checks the product against your requirements at that point and records the result with its evidence. To get a review on every change that ships, see continuous threat modeling. [How continuous threat modeling works](https://clearly-ai.com/solutions/continuous-threat-modeling) ### Can Clearly AI close risks automatically when a fix is verified? Not yet. Automated remediation verification and auto-closing of risks in the risk registry are coming soon. Today, verified mitigations update residual risk and a reviewer closes the risk. ## See how a fix gets verified Bring your control baseline to the demo. We'll walk through how Clearly AI finds a mitigation in code, checks a control against its evidence, and keeps the risk registry current. - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [See the risk registry](https://clearly-ai.com/platform/resolve/risk-registry) ## Learn more - [Secure everything that ships](https://clearly-ai.com) - [We built the tool we wished we had](https://clearly-ai.com/about-us) - [One platform. From intake to remediation.](https://clearly-ai.com/platform) - [Know everything that needs a review. Skip the 300-question form.](https://clearly-ai.com/platform/security-intake) - [Ask only what matters. Get it right the first time.](https://clearly-ai.com/platform/conversational-intake) - [Every finding, tracked to a decision](https://clearly-ai.com/platform/resolve/risk-registry) - [Show leadership and auditors exactly what security reviewed](https://clearly-ai.com/platform/resolve/reporting) - [Security reviews you can stand behind, every time](https://clearly-ai.com/platform/quality) - [Threat models built from the tools you already use](https://clearly-ai.com/integrations) - [Threat models that know about today's attacks](https://clearly-ai.com/platform/threat-intelligence) - [Automate every step around the review](https://clearly-ai.com/platform/workflows) - [Threat models your teams can work on together](https://clearly-ai.com/platform/collaboration) - [Understand the system before the review starts](https://clearly-ai.com/platform/enterprise-context-graph) - [Trust, security, and deployment](https://clearly-ai.com/platform/trust-security-and-deployment) - [Every plan reviewed. Every risky change threat modeled.](https://clearly-ai.com/platform/ide-and-mcp) - [Verify what actually shipped](https://clearly-ai.com/platform/control-and-remediation-verification) - [A current threat model for everything that ships](https://clearly-ai.com/solutions/continuous-threat-modeling) - [Prove every product that ships meets your security bar](https://clearly-ai.com/solutions/product-security-assurance) - [Privacy reviews your team can stake decisions on](https://clearly-ai.com/solutions/privacy) - [Every vendor reviewed against your standards](https://clearly-ai.com/solutions/third-party-risk) - [Review every design before it's built](https://clearly-ai.com/solutions/design-and-architecture-reviews) - [Secure the AI you build, buy, and code with](https://clearly-ai.com/solutions/ai-agentic-security) - [Every regulation you answer to. One review process.](https://clearly-ai.com/solutions/compliance) - [Every product ready for the Cyber Resilience Act without growing your team](https://clearly-ai.com/solutions/compliance/cyber-resilience-act) - [Build vs. buy for security review automation](https://clearly-ai.com/compare/claude-chatgpt) - [The ThreatModeler alternative built from your own docs, code, and policies](https://clearly-ai.com/compare/threatmodeler) - [The Clover Security alternative with findings your team can trust](https://clearly-ai.com/compare/clover) - [The Prime Security alternative for every review your team runs](https://clearly-ai.com/compare/prime) - [Security and Privacy](https://clearly-ai.com/trust/security-privacy) - [Clearly AI Privacy Policy](https://clearly-ai.com/trust/privacy-policy) - [Clearly AI Subprocessors](https://clearly-ai.com/trust/subprocessors) - [AI Risk Reviews](https://clearly-ai.com/use-cases/ai-risk-reviews) - [Automate Triage](https://clearly-ai.com/use-cases/automate-triage) - [Privacy Impact Assessments](https://clearly-ai.com/use-cases/privacy-impact) - [Vendor Risk Assessments](https://clearly-ai.com/use-cases/vendor-risk) - [Threat Modeling](https://clearly-ai.com/use-cases/threat-modeling) - [Contact](https://clearly-ai.com/contact) - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [Latest from the Clearly AI blog](https://clearly-ai.com/blog) - [In the news](https://clearly-ai.com/press) - [How Ericsson Enterprise Wireless Solutions cut review times by up to 80%](https://clearly-ai.com/customer-stories/ericsson) - [How HID Global reviews 300+ products for the Radio Equipment Directive with the team it already has](https://clearly-ai.com/customer-stories/hid-global) - [How Rivian scaled privacy and AI governance reviews 4x without adding headcount](https://clearly-ai.com/customer-stories/rivian) - [Part 2! Okay, privacy is different from security. Now what?](https://clearly-ai.com/blog/part-2-okay-privacy-is-different-from-security-now-what) - [How AI is rewiring our product engineering workflow](https://clearly-ai.com/blog/how-ai-is-rewiring-our-product-engineering-workflow) - [Good Data Scientists and Bad Outcomes, Part 1: What's the difference between security and privacy work?](https://clearly-ai.com/blog/good-data-scientists-and-bad-outcomes-what-s-the-difference-between-security-and-privacy-work) - [Why I Joined Clearly AI](https://clearly-ai.com/blog/why-vp-marketing-joined-clearly-ai) - [Skip the Marketing: Clearly AI for Technical People](https://clearly-ai.com/blog/clearly-ai-technical-explanation) - [Clearly AI Raises $8.4M Seed Round to Scale Product Security](https://clearly-ai.com/blog/seed-round) - [Why We Started Clearly AI](https://clearly-ai.com/blog/why-we-started-clearly-ai) - [Applying AI to Threat Modeling - Where AI Thrives, Survives, and Dies](https://clearly-ai.com/blog/applying-ai-to-threat-modeling) - [Why We Build in Public](https://clearly-ai.com/blog/why-we-build-in-public) - [Solving the Threat Modeling Bottleneck with AI Workflows](https://clearly-ai.com/blog/solving-the-threat-modeling-bottleneck-with-ai-workflows) - [Clearly AI Named Finalist in the 2025 Okta Startup Challenge](https://clearly-ai.com/blog/clearly-ai-named-finalist-in-the-2025-okta-startup-challenge) - [Security, SOC 2, & Startups](https://clearly-ai.com/blog/security-soc-2-startups) - [Building Reliable AI Systems for Security and Privacy Reviews](https://clearly-ai.com/blog/building-reliable-ai-systems-for-security-and-privacy-reviews) - [How to Automate Security and Privacy Reviews with Clearly AI](https://clearly-ai.com/blog/how-to-automate-security-and-privacy-reviews-with-clearly-ai) - [One Year of Clearly AI](https://clearly-ai.com/blog/one-year-of-clearly-ai) - [Navigating EU RED Compliance: Meeting the August 2025 Deadline](https://clearly-ai.com/blog/navigating-eu-red-compliance-meeting-the-august-2025-deadline) - [The AI Engineer Cheat Sheet](https://clearly-ai.com/blog/the-ai-engineer-cheat-sheet) - [Intelligent Vendor Risk Assessments](https://clearly-ai.com/blog/intelligent-vendor-risk-assessments) - [Clearly AI wins the AWS Bedrock Builder's Challenge](https://clearly-ai.com/blog/clearly-ai-wins-the-aws-bedrock-builder-s-challenge) - [Reviews, reviews, reviews!](https://clearly-ai.com/blog/reviews-reviews-reviews) - [Halfway through YC](https://clearly-ai.com/blog/halfway-through-yc) - [llms.txt — site overview for LLMs](https://clearly-ai.com/llms.txt) - [llms-full.txt — full site content for LLMs](https://clearly-ai.com/llms-full.txt) - [sitemap.xml — all public routes](https://clearly-ai.com/sitemap.xml) - [Documentation](https://docs.clearly-ai.com/docs) [Canonical page](https://clearly-ai.com/platform/control-and-remediation-verification)