The loop is the deliverable. Not the report.
The Security Loop closes scan-to-fix. A scanner produces a finding. An autopilot playbook drafts the mitigation PR. A human approves. Every step signs into one hash-chained record you can hand to your auditor.
The problem is the gap between find and fix.
Findings age in a ticket queue.
The scanner produces a report. It becomes a Jira board. Six weeks later, a stressed engineer either fixes it, silently downgrades it, or loses it.
The scan is not the outcome.
Buying more scanners produces more findings, not fewer vulnerabilities. The bottleneck was never detection. It was remediation.
Audits ask for proof, not tickets.
An auditor wants to see the specific finding, the specific fix, and the reviewer who approved it. Screenshots do not survive scrutiny.
How the loop actually runs.
Five steps. Each one leaves an audit line behind. The scan-to-fix distance becomes a number you can graph and move.
Scan
Findings from Semgrep, Trivy, Snyk, Gitleaks, GitHub Advanced Security, or any tool that produces SARIF or JSON feed into one Guard findings table.
Route
Findings above a configurable severity threshold trigger the autopilot playbook. Below it, they stay visible but wait for triage.
Draft
The autopilot playbook reads the finding, understands the file, and drafts the mitigation PR. It runs inside a sandbox with scoped credentials, not the full repo write key.
Approve
A code owner reviews. CI runs. When the PR merges, the finding closes with the merge SHA and the reviewer identity attached.
Prove
The full chain (finding, PR, approval, merge) is one hash-chained record. Signed. Queryable. Handed to an auditor as evidence.
Metrics that move once the loop is running.
Mean time to remediation
The number your CISO cares about. Watch it fall.
Findings closed per week
Loop throughput. Distinct from findings opened per week.
Autopilot success rate
PRs merged without rework as a share of PRs drafted.
Human approvals per week
The load on your reviewers. Guides scaling decisions.
Plugs into what you already run
Any scanner that produces SARIF or JSON feeds Guard. Custom scanners work with a small adapter. No rip-and-replace.
Stop shipping reports. Start closing findings.
The Security Loop is a shipped Guard surface. Install it on your workspace and point your first scanner at it in an afternoon.