Checkmarx Triage and Remediation

Checkmarx Triage and Remediation is the security-side member of the Checkmarx Agentic AI pillar. It runs against the Checkmarx One findings store and works the AppSec team's queue: clustering related findings by root cause, drafting remediation paths, ranking by EPA reachability and Best Fix Location data, and routing the result back into the triage workflow. Where Developer Assist sits in the IDE for the engineer, Triage and Remediation sits next to the AppSec analyst reviewing thousands of open findings.

Clustering is the load-bearing capability. A single root-cause issue (a misconfigured input validator, an outdated crypto library called from twenty entry points) typically generates dozens of distinct findings across SAST flow paths, SCA reachability scores, and runtime DAST signal. Triage and Remediation groups those findings, surfaces the single root cause, and proposes one remediation that closes the cluster instead of forcing the analyst to triage each finding separately. On large backlogs that pattern alone cuts AppSec review hours by a meaningful margin.

Learning is the quieter capability. The agent records how the AppSec team triaged similar findings before (accepted, suppressed with rationale, escalated to engineering, downgraded by reachability) and applies that pattern to new findings. Programs that have triaged the same family of issues a hundred times get the agent's pre-triage rather than starting from zero on finding 101. Triage decisions feed back into Developer Assist on the dev side, so the AI loop closes between the two pillars.

What undermines Triage and Remediation adoption is treating it as autonomous suppression. The agent proposes; the AppSec analyst decides. Programs that auto-accept the agent's clustering and suppression suggestions ship policy drift, because the agent will sometimes cluster things that the human would have triaged differently. Merito's engagement defines the supervision boundary, tunes the agent against the customer's actual triage history, and writes the audit trail required for regulated programs.

Merito has worked with AppSec programs sitting on 50,000-finding backlogs that nobody touches because the volume is paralyzing. The instinct is to look for an AI that can auto-suppress noise. The right move is an AI that clusters findings on root cause so the AppSec analyst triages one cluster instead of one finding. Triage and Remediation does the second thing well; programs treating it as the first thing introduce policy drift.

Merito recommends Triage and Remediation specifically when the AppSec backlog is large enough that triage hours are the binding constraint, when triage history exists in some form to seed the agent's learning, and when the AppSec team is willing to supervise rather than auto-accept the agent's output. For small backlogs or programs without prior triage history, the agent works but the differentiation against manual triage is muted. Merito surfaces that during scoping rather than letting customers buy seats that will not pay back.

The pairing with Developer Assist is the load-bearing move on the bigger picture. Sec-side triage decisions feeding into dev-side suggestions is what makes the AI loop sharpen over time. Programs licensing only one half of the loop are running half a program. Merito recommends both or neither.