Fix Desk: agent-written patches with change-control evidence for regional banks
Agents draft and test patches for AI-found flaws in bank-owned code, packaged for change approval. Regional bank CISOs pay.
Competitive · BofA hires 1,000 patch contractors
Written for: Small startup team
Next step
Call the head of application security at a $20–80B US regional bank, through an FS-ISAC contact if needed, and ask how many AI-found findings are open and what a contractor costs per closed one.
Why now
Patch Exception Desk ranked patches and documented exceptions. What changed is that the BofA disclosure shows the money is going to fixing, and a $30B regional bank cannot hire 1,000 contractors. The BoE and IMF are warning about cyber risk to banks. Agent-drafted patches checked by test suites now work at Chromium scale, which makes paying per closed finding a believable alternative to contractor hours.
What became possible
Bank of America's 1,000 contractors are the first hard cost figure for fixing what frontier models find. Wiz says Gemini 4 Argon found more than twice as many vulnerabilities as baseline models. Google shows Argon agents refactoring Chromium, checked by its test suites and engineer review. Codex code review is generally available.
Three ways in
- Fix Desk
Takes a scanner finding, has a coding agent draft the patch and a regression test inside the bank's VPC, runs them in the bank's CI, and opens a change ticket with risk notes.
- Customer
- Application security lead at a $10–100B regional bank
- Model
- Price per closed finding, set below the contractor cost per finding
- Change-board pack
Generates the change-approval write-up, a rollback plan and a test-evidence summary for each patch, ready for auditors.
- Customer
- IT change management and internal audit
- Model
- Bundled; also sold standalone per seat
- Cost-per-fix benchmark
A two-week paid pilot that measures cost and time per closed finding against the bank's current IT-services contract.
- Customer
- CISO building the budget case
- Model
- Fixed-fee pilot
Competition
The main risks are that Tandem, Rivial or a credit union service organization (CUSO) adds this as a module, that Qualys extends Agent Sara to cover exceptions, and that the per-institution budget at this asset size is small. That probably points to selling through CUSOs, vCISO firms or MSSPs rather than direct.
Full competition notes (12 competitors)
Neither half of this idea is new on its own. Ranking Patch Tuesday by asset context is now built into the scanners. Qualys has Agent Sara and Tenable has the free Patch Shepherd skill. Exception and risk-acceptance workflows ship in Rapid7, ServiceNow, ArmorCode and Cogent, and ServiceNow can already have AI write deferral justifications. A standalone general-purpose ranker would be competing with features the customer's scanner vendor gives away. The opening I could see is narrow, and it is vertical. None of the products I found writes exception memos in the format NCUA and FFIEC examiners expect. That means mapping each exception to Part 748 Appendix A and the ISE procedures, and producing the annual patch-management section of the board report. None of them uses core-banking and payments connectivity as a first-class exposure signal, and none works across Tenable, Qualys and Defender at once for a team of two to five people that will never buy ServiceNow. The credit-union compliance vendors, CoNetrix Tandem and Rivial, own the examiner-documentation relationship but don't appear to touch scanner data or patch exceptions. A new entrant could win by being the thin layer between the scanner and the exam binder: import the scans, flag exceptions against the institution's own patch policy, draft memos an examiner will accept, and keep the audit trail. The main risks are that Tandem, Rivial or a credit union service organization (CUSO) adds this as a module, that Qualys extends Agent Sara to cover exceptions, and that the per-institution budget at this asset size is small. That probably points to selling through CUSOs, vCISO firms or MSSPs rather than direct.
- Qualys Agent Sara (Patch Tuesday agent)
An AI agent from Qualys that maps each Patch Tuesday release to the customer's assets, ranks fixes by asset criticality and business context, and drafts patch jobs for a person to review. This is close to the Exposure Ranker, and it ships inside a scanner many credit unions already pay for.
- Tenable Patch Shepherd
An open-source skill on Tenable's exchange. It pulls Tenable inventory exports and scores patch campaigns as VPR times asset criticality. It is a free, transparent version of the ranking idea.
- ServiceNow Vulnerability Response exception management with AI guardrails agent
Covers the full deferral and exception request, review and approval workflow, and its AI agent can write deferral justifications. It is the closest match to the Exception Memo Writer, but it is enterprise-priced and seldom used at $500M to $5B credit unions.
- Rapid7 InsightVM vulnerability exceptions
Built-in exception workflow with separate submit and approve permissions and support for compensating controls. It is generic, not written for examiners.
- Critical Start Vulnerability Prioritization
Takes in Qualys or Tenable scans and adds business context, exploit availability and threat intelligence to rank fixes. Delivered as a managed service.
- Expel Vulnerability Prioritization
A managed service that combines exploitability and real-world attack evidence with the customer's business and asset priorities.
- Cogent Security Risk Exceptions
A newer AI-native vulnerability platform with a structured risk-exception feature that records accepted-risk decisions and leaves them out of metrics.
- ArmorCode exceptions management
An exposure and ASPM platform that markets governed exceptions: documented justification, an owner, time-bound SLAs and compensating controls.
- CoNetrix Tandem
GLBA and FFIEC compliance software built for banks and credit unions. The vendor says it serves more than 600 institutions. It covers risk assessment, policies and vendor management, and is mapped to NCUA ISE procedures. I found no patch-exception module, but it already owns the examiner-documentation relationship with this buyer.
- Rivial Data Security
vCISO software and services for small credit unions, including board reporting and reminders about vulnerability scans. I found no evidence of patch ranking or exception memos, but it sells to the same buyer.
- Vicarius vRx
An agent-based vulnerability discovery and patching tool. It has credit union customers, including Hawaii State FCU.
- DeepSurface
Risk-based vulnerability prioritization by attack path, with a credit union case study (REV Federal Credit Union).
Checked 2026-10-14
Risks
- Banks won't let an outside agent touch source code without an on-prem deployment
- An agent patch that changes behavior in a money path is a serious incident
- IT services firms can bundle the same tools into their existing contracts
- Frontier labs and Wiz-style vendors are moving into remediation
Strong market pull; open space and buildability are the weak point (5).
tech 6 · pull 8 · space 5 · fit 6 · build 5
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's MythosCNBC
- Using Gemini 4 Argon to protect against Cyber attackersGoogle DeepMind
- Applying Gemini 4 for large-scale codebase maintenance in ChromiumGoogle DeepMind
- Code review is no longer the bottleneckOpenAI
- BoE and IMF warn of cyber threat to banking systemFinextra
Status history
- 2026-10-14 Flagged as buildable