Every security team in every organization that builds software is grappling with the same problem: The vulnerability backlog. It’s out of control. This is being driven both by the dramatic increase in code (much of it AI generated) as well as the flood of newly disclosed CVEs (fueled by increased testing of open source by maintainers and security researchers). We see it too. The rate of CVE disclosures has doubled over the last three years, and the average number of affected OSS component per CVE has risen six-fold.
At the same time, AI has given hackers capabilities that until recently were only available to well-funded cybercriminal organizations and state-sponsored cyberterrorist. The Mean Time to Exploit (MTTE) has effectively dropped to zero, while many teams still track remediation SLAs in days or even weeks.
If you look at these two realities together, the message is clear. The old way of doing application security is simply not sustainable.
Watch an overview of Signal Agentic Fix
Combating AI-powered exploits with machine-speed remediation
Today we’re introducing a new AI agent that enables security and development teams to burn down their vulnerability backlog at the speed required by AI. Signal Agentic Fix combines fast, efficient, and accurate static and software composition analysis with AI automation, reasoning, and code generation, to find and fix security issues in both first party code and supply chain dependencies at machine speed, while ensuring security and development teams have complete visibility and control of what changes are made to their code.
Agentic Fix works like a member of your team dedicated to the task of remediating vulnerabilities by performing five tasks.
- Scan target code for vulnerabilities: Agentic Fix analyzes code with the same deterministic SAST and SCA engines used in Polaris, Coverity, and Black Duck SCA. This ensures consistent and fast results every time. Signal AI Code Analysis support will also be added for runs where you want to dig deeper to find novel security risks like IDOR and BOLA.
- Triage the findings: In an era of AI-powered exploits, it’s extremely important to focus on vulnerabilities that are reachable, exploitable, and have a significant impact. Agentic Fix uses AI to analyze the results from the security scan, to determine if the vulnerabilities are reachable, how they could be exploited, and what the impact would be.
- Generate a fix: Agentic Fix then works with your selected LLM or AI Coding Agent, to generate a fix. This can be a modified code block for proprietary code defects or a component update for issues with supply chain dependencies.
- Validate that the fix didn’t break anything: Every developer knows that fixing any bug is a two-step process. You fix the bug, then you fix the fix. Agentic Fix does that too, verifying that fixes don’t introduce new security issues. It will also leverage other automated tests you configure to ensure fixes don’t break functionality, performance, or compliance. If tests fail, a new fix is generated and re-validated.
- Submit the fix for human review: This is extremely important for many teams, especially those building mission critical software where reliability and functional safety are critical. Signal Agentic Fix works within normal review and approval workflows. Developers can approve individual fixes in their IDE or Coding Agent session, and teams can review and approve bulk fixes as SCM pull requests.
One agent. Multiple assignments.
Agentic Fix is designed to integrate into the two main loops of software development and testing.
Agentic Fix for Coding Agents works as a companion to tools like Claude Code and GitHub Copilot. Developers can use it to both reduce the time it takes them remove security defects in code that has already been written and keep security defects from being introduced as AI writes new code.
Agentic Fix for DevOps Pipelines enables teams to remediate vulnerabilities in bulk within SCM and CI/CD pipelines. SCM or CI events can trigger Agentic Fix test, triage, fix, and validate runs with results submitted back as annotated pull requests for human review and approval.
In both cases Agentic Fix works with your existing Polaris, Coverity, or Black Duck SCA instance, using configuration and policy settings to govern how it works and delivering results back for centralized reporting, review, and trend analysis.
Human control without the human bottlenecks
Let’s face it. No team has enough developers or security champions to keep up with the pace of vulnerabilities and AI-powered cyber-attacks. And while complete and accurate analysis and discovery of security defects is more important now than ever, the new question for teams is can they fix those vulnerabilities within the hours—not days or weeks—it takes for hackers to find and exploit them?
For most teams today, the answer is probably “no.” And the reason it’s “no” is not because their developers aren’t skilled enough to fix those vulnerabilities. Yes, some fixes require more time to implement than others. But for many (perhaps most) vulnerabilities, the fix is fairly trivial. The latency is introduced through notification gaps and limits on the size and working hours of the team.
With AI and Signal Agentic Fix, teams have access to an agentic remediation workforce that has massive capacity, can respond instantly to any issue or alert, and works 24 hours a day, 7 days a week, 365 days a year, doing remediation work most developers hate doing anyway.
At the same time Agentic Fix keeps humans in control of what matters most: Ensuring the changes to the code are reviewed and approved before they are applied. AI delivers the autonomy, while humans retain the accountability.
Try it today
Signal Agentic Fix is available for early access as a Claude Code plug-in for Coverity users, with support for other coding agents and DevOps pipeline tools coming soon for Coverity, Polaris, and Black Duck SCA.
We’re really excited for your teams to try it to see how it can help them stay on top of that vulnerability backlog and stay ahead of AI-powered exploits.
