Root: Automating the Remediation Gap

Name: Root: Automating the Remediation Gap (English version)
SKU: W47259

Dave Chatterjee

Product #:W47259

Supplier:Ivey

Discipline:Entrepreneurship, Strategy

Setting:United States, 2025

Details:Case (PDF) • 3 pages • 2026-01-07 (Rev: 2026-04-24)

Industries:

Business services sector

Your Price:

$9.71

Purchase this material with a free Educator Account and enjoy more benefits:

Free Educator Copy
Free Teaching Notes
Build your coursepack
Discounted academic price

In early 2025, the co-founder and chief technology officer of Root.io Inc. (Root), based in Boston, Massachusetts, was preparing to brief his leadership team on the company’s next strategic phase. Root was an emerging cybersecurity company founded on the bold mission of eliminating security debt by automating the fix, not just the flag, in cybersecurity. Its differentiating advantage was the use of agentic artificial intelligence (AI) to remediate vulnerabilities at machine speed, while embedding human oversight to ensure safety and trust. Root had already proven its technology. However, the company now faced the more complex business challenge of positioning and scaling the company in a conservative trust-driven market. With three potential strategic paths available for his venture’s growth, Amaral’s dilemma was centred on whether Root could balance speed—its innovation edge—with governance, which was the credibility anchor for regulated industries.

Learning Objectives

This case is appropriate for graduate courses in MBA, executive MBA, master of cybersecurity, or technology management programs, as well as executive education modules on AI governance and adoption, cybersecurity strategy and leadership, or digital resilience and innovation scaling. The case provides students with a realistic view of a start-up at an inflection point, having technically validated its model but needing to persuade risk-averse enterprises that AI-generated patches (known as automated remediation) can be both safe and strategically sound. The case also challenges students to navigate the quintessential innovation dilemma of how to scale trust as quickly as technology. After completion of this case, students will be able to

examine why organizations remain vulnerable despite sophisticated detection tools and explore Root’s value proposition as a business response;
analyze the risks, benefits, and governance imperatives of delegating remediation to AI systems;
use Dave Chatterjee’s commitment–preparedness–discipline (CPD) model to assess how organizations can responsibly integrate automation into security operations;
explore how emerging firms can persuade conservative markets to adopt disruptive innovations; and
evaluate the trade-offs between speed and governance, and how strategic positioning shapes adoption outcomes.