Black Duck Adds AI Agent to Triage and Fix Vulnerabilities

Patrick Carey, vice president of product marketing for Black Duck, said the Signal Agentic Fix agent leverages the company’s static application security testing (SAST) and software composition analysis (SCA) engines to provide a harness that discovers vulnerabilities in proprietary code and open source dependencies, and then validates any fixes the AI agent generates. The fixes themselves are generated using either AI models made available by Black Duck or a supported model that DevSecOps teams prefer to invoke, said Carey. Additionally, rules can be configured to define what the agent is allowed or required to fix and how to do it.

Those rules can also be used to establish coding and compliance standards that the AI agent must follow. Any generated fix is then rescanned to confirm that it does not introduce new defects or vulnerabilities. The overall goal is to make it simpler to reduce a growing backlog of vulnerabilities requiring remediation as AI models are increasingly used to discover them, said Carey.