Cloudgeni

Cloudgeni is a cybersecurity tool. Cloudgeni runs policy-governed AI agents across your cloud estate: they handle compliance remediation, drift reconciliation, cost rightsizing and PR review, shipping routine IaC fixes within rules you write in plain English and escalating only what the policy cannot verify.

Cloudgeni is an agent platform for cloud infrastructure teams. Instead of asking engineers to write prompts or babysit automations, it asks them to write a policy once. The agents then detect problems, investigate them, prepare fixes in infrastructure as code, validate those fixes against the policy, and merge or apply them where they are allowed. It is built by an IBM partner company and runs on Opengeni, an open-source agentic runtime that handles durable, sandboxed and human-approved agent runs under the Apache-2.0 licence. The central control is the workspace policy. Each workspace has an authority level: Off (no continuous agent work), Observe (detect and report only), Propose (open branches and pull requests but never merge) and Governed (merge and apply eligible changes through deterministic safety gates). Rules are written in plain English, for example restricting deployments to EU regions, requiring an owner tag on every resource, or capping monthly workspace spend. Anything the policy cannot verify, along with changes to identity, secrets, state or CI, is escalated to a person with the supporting evidence. An emergency stop pauses all autonomous work in the workspace, and production autonomy stays off unless an admin enables it in Governed mode. Out of the box there are predefined workflows for compliance remediation, drift reconciliation, pull request review, IaC pipelines, cost optimization, incident investigation, resource import and turning labelled work items into pull requests. Teams can also add scheduled workflows that run a custom prompt hourly, daily or on a cron and report by Slack or email. The tool works across AWS, Azure, Google Cloud, Oracle Cloud, Kubernetes, OpenShift and on-prem, and reads signals from sources such as Prowler, Security Hub, Defender, Vanta, Datadog, Grafana and the main Git providers. Frameworks covered include CIS, ISO 27001, SOC 2, NIS2, DORA, HIPAA, PCI-DSS, the EU AI Act and ISO 42001. This is aimed at platform and SRE teams with real IaC estates and audit obligations, not hobby projects. Comparable ground is covered by cloud security posture tools and IaC scanners, but those mostly report findings and leave the fix to a human. Cloudgeni's differentiator is closing the loop with governed, auditable changes.