Bedrock Data launches AI workflow to cut exposure backlogs

Bedrock Data has launched an AI-assisted remediation workflow for data exposure that routes issues to data owners through Jira and ServiceNow.

The launch reflects a broader push by companies to manage growing volumes of sensitive data exposure as AI tools gain access to corporate systems.

The workflow is designed to shift remediation work from central security teams to the engineering, data and business teams that own the underlying systems and datasets. The platform identifies the owner of an exposed dataset, creates a ticket in Jira or ServiceNow, and provides context on the issue within that workflow.

When a ticket is marked resolved, the system checks whether the exposure has actually been fixed. If the problem remains, it reopens the ticket and explains why. The feature is generally available and included in the platform.

Backlog pressure

The product enters a market where many data security tools focus on discovery and visibility but leave remediation to security teams with limited resources. Bedrock Data argues that this model struggles to cope with the scale of modern enterprise data, which often spans petabytes of information, millions of documents and thousands of data stores.

Its Enterprise Data Security Confidence Index found that 76% of respondents said a lack of automation and too much manual work were holding back data security efforts. The company also pointed to broader concern over AI agents and copilots accessing data at machine speed, potentially surfacing files or records that had long gone unnoticed in test environments or broadly shared folders.

Research from EY found that 85% of executives at companies using AI agents said some of those agents take important actions without real-time human involvement. That has sharpened concerns that unresolved data exposure could more easily lead to leaks, misuse or compliance breaches.

Bruno Kurtic, Chief Executive Officer and Co-Founder of Bedrock Data, said the issue is one of ownership as much as detection.

“Every enterprise has far more data issues than its centralized data security team can action. Until now, with data growing exponentially, risk accumulation and risk remediation were divergent curves. Data is the responsibility of the lines of business and the data organization, and remediation only scales when they own the fix,” Kurtic said.

“Bedrock Data finds the owner, sends the issue to the tools they already use, answers their questions inside the ticket and verifies the result. Security teams keep control of the rules and the audit trail, and those curves no longer diverge because remediation now operates at scale,” he added.

Existing systems

Rather than requiring customers to adopt a separate interface, the workflow runs through IT service management systems already used by many companies. Security teams can set default routing rules in natural language and override them where needed, such as directing findings in a particular cloud account to a platform team unless the problem concerns access permissions.

The workflow runs continuously as scans detect new exposures, making remediation an ongoing process rather than a one-off clean-up effort. In some cases where the response is clearly defined, the platform can also make changes directly, such as revoking document sharing based on sensitivity and policy settings, while notifying the relevant owner.

Customers will also be able to opt in to more automated remediation for recurring exposure types when business teams are comfortable allowing the system to act without opening a workflow ticket.

Audit trail

Bedrock Data also framed the workflow as a governance and compliance tool. Every exposure handled through the system carries an owner, a timeline and verification that the fix held, creating an audit trail that can be used in reviews tied to PCI DSS 4.0.1, SOC 2 and New York State Department of Financial Services Part 500 requirements.

Industry data cited by the company from IBM's 2026 Cost of a Data Breach Report found that organisations making extensive use of AI and automation in security operations had average breach costs USD $1.93 million lower and incident lifecycles 65 days shorter than organisations that did not.

For customers, the practical test will be whether routing issues to the business reduces the backlog without creating new friction between security teams and operational units. Bedrock Data said the model is intended to give business owners the information they need to fix issues in the systems they already run, while allowing security teams to retain oversight of rules and evidence.

Sportradar, a Bedrock Data customer, said that balance is central to making remediation work at scale.

“Data risk is my team's responsibility, but lasting fixes have to come from the teams who run the systems every day,” said Manish Chandela, EVP Information Security, Risk and Privacy at Sportradar.

“Seeing the risk is table stakes. Reducing it means getting thousands of issues fixed without breaking the business. Bedrock Data puts each issue in front of the right owner, with the context to fix it, inside the tools they already use, and then proves the fix held. Remediation stops being a backlog my security team carries and becomes a program the whole company runs, with the evidence our board and auditors expect,” Chandela said.