> ## Documentation Index
> Fetch the complete documentation index at: https://docs.antigen.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How remediation works

Remediation turns a confirmed vulnerability into a set of changes your team can review and deploy. It uses the evidence from the original offensive run and the investigation completed during triage to address the actual cause of the issue.

## Start remediation

When triage assigns a vulnerability to Antigen's `remediation-agent`, an assignment-change hook starts remediation. The agent receives the live vulnerability, the triage investigation, and the logs and evidence from the offensive run that discovered it.

The agent produces a set of `RemediationSteps` for your review. Each step describes a concrete change needed to resolve the vulnerability.

## Send work to the right place

`remediation-agent` writes `RemediationSteps` to the connected tools your team uses to manage work. Depending on the change, it can create:

* A GitHub pull request for a code change.
* A Linear or Jira ticket.
* A GitHub issue.
* A Slack notification for an infrastructure change, such as updating an S3 storage configuration.

Your team reviews and completes the work through its normal workflow. Antigen does not merge or deploy changes for you.

## Use infrastructure context

The Asset Map and connected integrations give `remediation-agent` context about your infrastructure. It can use that context to understand the affected systems and map the changes required to resolve the vulnerability.

## Confirm the fix

After a fix is deployed, the vulnerability moves to `remediated`. Antigen then uses an offensive agent to rerun the original exploit against the approved target.

If the exploit no longer succeeds, the vulnerability moves to `verified`. If it still succeeds, it returns to `open` with the new evidence from verification. This starts triage again.