What is security program management in Nullify?

It is the part of Nullify that runs your security program: it maintains one prioritized backlog across every capability, monitors emerging threats, knows who owns what and how much they already have on their plate, and drives work to completion through campaigns — opening PRs, filing tickets, nudging and escalating.

Which findings can a campaign target?

Campaigns cover code, dependency, container, secret and pentest findings, and can be scoped by finding type (specific CWEs or CVEs), repository, team, individual, severity, or a combination.

Does Nullify act without approval?

Only within the boundaries you set. A security leader decides each campaign's scope and automation level, ground rules and blocked action types limit what Nullify can do on its own, it won't move work across teams without approval, and it raises an action item whenever it needs a human decision.

What does it report on?

Mean time to remediate (MTTR), current finding counts, and campaign progress — resolved versus remaining, per team, with SLA compliance.

Book a live demo

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.

Remediation

Every fix
driven all the way to merge.

Nullify writes the fix, routes it to the engineer who owns the code, refactors from CI logs until it passes and escalates until it merges.

Book a Live Demo Read the Docs

Finding it is the easy part. Closing it is the job.

89%merge-ready rate
across our customers

~1 in 10fixes need a developer
to refactor before merge

Ownerevery fix routed to the
engineer who can merge it

From a validated finding
to a merged pull request

Route

Sent to the right reviewer

Assigned from code ownership and current review capacity, so the pull request reaches the one engineer who can merge it fastest.

Pull request #1284 · Verify signed role claims

owner · payments team

reviewer · @priya-k 2 open reviews

Assigned · fix and reproduction attached

Self-heal

Refactors itself until it passes

When CI fails, Nullify reads the build logs and pushes follow-up commits until every check is green. No developer babysitting.

nullify added 2 commits

fix(deps): upgrade jsonwebtoken ✗ b4dc545

fix: handle malformed tokens ✓ 821e8aa

All checks passing · merge-ready

Escalate

Chases it to merged

Follows up on stalled reviews and escalates in Slack with full context when a judgment call or an SLA needs a human.

Slack · #security-escalations

Fix #1284 touches a helper used by 3 services. Owner sign-off needed.

Marcus approved and merged.

Merged · finding closed

Proof, Stacked

01Fix

02Route

03Refine

04 · MergeClosed, not filed

The work ends in a merged pull request and a closed finding, with the reproduction, the fix and every follow-up kept on the record.

Questions Security Teams Ask First

Who reviews and merges the fixes?

Your engineers. Nullify routes each pull request to the owner of the code and prepares it so the review is quick; a human always makes the merge call.

What if a fix breaks the build?

Nullify reads the CI logs, works out why, and pushes follow-up commits until the checks pass.

Can we fix many vulnerabilities at once?

Yes. Campaigns group work by CWE, CVE, repo or team and pace the pull requests so developers aren't flooded.

See it on your backlog

Watch a Fix Reach Merge

Book a demo and see Nullify take a finding from your backlog all the way to a merged pull request.

Book a Live Demo Triage