Moritz Johner

The best enterprise use case for agents is not glamorous. It is the work every engineer agrees matters, every team deprioritizes, and every security review eventually drags back into the room. CVE remediation is the perfect example because the small-scale story is so seductive: bump the dependency, run CI, merge the PR and move on. That story collapses when you own thousands of repositories. Now the hard part is not the patch. It is finding the right artifact, proving the right fix, reconciling CI, containing the agent, and producing enough evidence and observability for people to trust the outcome. This talk is a production case study of PatchPilot, an agentic remediation platform built in a regulated industry. I will show how we moved from prototype to production with controller loops, remediation agents, CI reconciliation, approval boundaries, egress controls, observability, and metrics that proved whether the system was creating value or just burning tokens. The hard part was not getting an agent to open a pull request. The hard part was making it constrained enough for infosec and useful enough for engineers. This is the story of what failed, what changed, and why boring work might be the best place for agents to prove they belong.