Snyk

Agents write code faster than security teams can triage it. New critical and high-severity issues across Snyk customers grew 10x in the past year. Today we launched Evo Agentic AppSec: a team of security agents that finds, fixes, and blocks vulnerabilities at the speed agents write code, with every result verified independently of the agent that produced it. Evo Code Scanning Agent catches the access control and authentication flaws pattern-matching misses. Evo Dependency Firewall blocks malicious and slopsquatted packages at install. Evo Agentic Security Review threat-models a full repository and returns evidence-backed findings. Evo Remediation Agent ships fixes you can merge: 90% of the time on open source dependency issues, versus 59.6% for an LLM alone. And Evo Secrets Detection catches leaked credentials from IDE to CI. Read the full announcement: https://lnkd.in/en-YET-s

The AI hurricane is here. Debating its speed will not “weatherproof” the software we already run or protect against the attackers who aren’t slowing down. Creation moved to machine speed. Validation did not. Meanwhile, agents are writing code, choosing tools, and acting in production—and attackers can exploit that growing exposure with AI of their own. Dario & Sam’s call for independent lab evaluators and George Kurtz’s answer is the operational one: the frontier moves at whatever speed it moves, but the rest of the world does not slow down. Both are right. But we have to take it one layer upstream. I’d extend that responsibility into development. ❓Who governs the agents doing the writing? ❓Who checks the tools, skills and MCP servers they trust? ❓Who independently validates the code, and the fixes they ship? The system creating a change cannot be its own sole validator. We need independently executed tests, production evidence, and validation controls the generating agent cannot alter. And defenders need the means to act. Open models, shared intelligence, and supported open-source maintainers belong inside the safety architecture. Continuous defense must be affordable and broadly accessible. ✅ Secure at inception. ✅ Enforce at runtime. ✅ Validate independently. Read my in-depth thoughts and recommendations here, along with the questions leaders should ask their teams (or their agents) now. https://lnkd.in/eiyiuxuj The strongest movement is still Open Source and Open Models. The Security companies are Allied. The Defenders are still standing strong. Open. Allied. Still Standing - thats the mantra to focus on the most important task right now and cut through the opera.

Today we're delivering the largest Snyk AI Security Platform expansion to date 💥 Evo Continuous Offensive Security, the adversarial proving layer enterprises have been asking for, is now in GA. Alongside it: Snyk Secrets in GA, a major AI-SPM upgrade, and a first look at Evo Agentic AppSec. It's security that keeps pace with how software is built, governed, and attacked, at every layer, and every stage of the agentic development lifecycle. Watch the video below and read the full story here: https://vist.ly/5dhqq

Traditional security testing provides a point-in-time view of your applications. Evo Continuous Offensive Security continuously validates real-world risk, helping your team uncover exploitable attack paths before attackers do.

Attackers don't wait for scheduled testing. Evo Continuous Offensive Security continuously uncovers exploitable attack paths across your applications, helping security teams identify and prioritize real risk before it's exploited. Learn how to stay one step ahead.

Attackers don't wait for your annual penetration test—and your security shouldn't either. Evo Continuous Offensive Security continuously tests your applications the way attackers do, uncovering exploitable attack paths and validating real-world risk before it's exploited. Because when threats are continuous, your security testing should be too.