Black Duck Adds AI Agent to Triage and Fix Vulnerabilities

Black Duck this week added an artificial intelligence (AI) agent to its portfolio that triages vulnerabilities and then generates and validates fixes for DevSecOps teams to review before applying them.

Patrick Carey, vice president of product marketing for Black Duck, said the Signal Agentic Fix agent leverages the company’s static application security testing (SAST) and software composition analysis (SCA) engines to provide a harness that discovers vulnerabilities in proprietary code and open source dependencies, and then validates any fixes the AI agent generates.

The fixes themselves are generated using either AI models made available by Black Duck or a supported model that DevSecOps teams prefer to invoke, said Carey.

Additionally, rules can be configured to define what the agent is allowed or required to fix and how to do it. Those rules can also be used to establish coding and compliance standards that the AI agent must follow. Any generated fix is then rescanned to confirm that it does not introduce new defects or vulnerabilities.

The overall goal is to make it simpler to reduce a growing backlog of vulnerabilities requiring remediation as AI models are increasingly used to discover them, said Carey. The only way to burn down that backlog will be to rely more on AI and automation, he added. In fact, that’s critical because AI now enables cybercriminals to reverse engineer a vulnerability and create an exploit in a matter of minutes, noted Carey.

In effect, Signal Agentic Fix augments DevSecOps teams that historically needed to review code created by human developers who typically outnumbered them ten to one. AI agents provide the additional “headcount” needed to scan and review code faster, regardless of whether it was created by a human or another AI agent, said Carey.

Signal Agentic Fix follows Black Duck’s introduction of its AI Fix Pull Requests capability earlier this year. The company expects to add additional AI agents to address threat analysis, penetration testing and, longer term, other aspects of software supply chain security, said Carey.

In general, organizations have made application security a significantly higher priority in the last 12 to 18 months, noted Carey. The challenge is that many still lack the tools and processes needed to continuously maintain the level of security required in an era when attacks are being launched at machine speed, he added.

Mitch Ashley, vice president and practice lead for software lifecycle engineering at the Futurum Group, noted that the bottleneck in application security has moved from finding vulnerabilities to fixing them, and AI is speeding up both discovery and exploitation. Black Duck checks every AI-generated fix with the same scanners that found the flaw, which gives teams evidence to review before anything ships, he added.

The configurable rules matter more than the model because they determine what the agent is allowed to change, noted Ashley. The next test is whether teams apply those rules where code is written, so flaws never reach the backlog, he said.

It’s not clear to what degree DevSecOps teams are revisiting existing workflows to better secure applications in the AI era. However, given the rate at which vulnerabilities are being discovered, it’s now more a question of when rather than if. Of course, not all those vulnerabilities are going to be equally exploitable, but as their numbers increase, so too does the probability of a significant breach being traced back to one or more known vulnerabilities.