There are a new generation of solutions, the first in the market today, that go beyond search and scanning to deliver true code auto-remediation capabilities. If remediation is the business goal, refactoring is the technical means to accomplish it.
Risk identification is not remediation
Code search is not remediation
Scanning and reporting is not remediation.
A simple test: "who is typing out the remediation in the code?" If it is a human, it isn't auto-remediation... it's manual remediation.
Moderne builds on top of OpenRewrite, which passes this test.