Global Property Data & Analytics Company grounds AI in software intelligence – SCA remediation drops from hours to minutes

CAST makes automated SCA vulnerability remediation reliable at portfolio scale for a global property data & analytics company by equipping AI with deterministic, application-level context – cutting per-application remediation from hours to minutes.

Challenge

The company's CISO and CIO issued a joint mandate: remediate every software composition analysis (SCA) vulnerability across thousands of repositories within six months. Done manually, patching averaged hours per application – so at portfolio scale, effort, not technique, was the binding constraint.

Before committing the full estate, the team needed proof that an automated approach could hold up reliably at speed under real production conditions.

Solution

To de-risk the mandate, the team piloted the approach on a defined slice of the portfolio – roughly 153,000 lines of code. CAST Highlight triaged at portfolio level, identifying which applications carried SCA vulnerabilities; CAST Imaging then worked at application level, deterministically mapping each vulnerability and its blast radius.

Through MCP, Claude Sonnet drew on that intelligence to generate grounded remediations, which were automatically applied, tested, and validated.

Results

On this bounded slice, AI grounded in CAST software intelligence cleared 94.7% of the SCA vulnerabilities identified – each fix applied, tested, and validated, not merely attempted. Where manual patching had cost hours per application, the automated loop cut per-application remediation effort by 12-20X.

Having proven both coverage and efficiency under real conditions, the organization is now extending the same deterministic process across its broader portfolio of thousands of repositories.