Burlington, Massachusetts, October 27th / PRNewswire / -- Leading application security provider for the AI era, Black Duck ®, today announces the launch of Signal Agentic Fix, the latest agent within Black Duck Signal ™. Signal is a set of AI agents designed to minimize human process bottlenecks and help teams protect software more quickly, keeping up with the rapid increase in vulnerabilities and exploitation methods driven by AI. Signal Agentic Fix combines Black Duck's leading deterministic static analysis (SAST) and software composition analysis (SCA) engines with AI-powered diversion, repair generation, and verification, and submits them for manual review before each change is merged.

Black Duck indicates that Signal Agentic Fix is aimed at two pressures that have intensified with the rapid spread of AI in software development. The first is the continuous expansion of an backlog of vulnerabilities, a problem driven by the surge in code generated by AI, the higher vulnerability rate of such code, and a large number of new supply chain CVE. The second is the significant reduction in time required: attackers use AI to string together and weaponize vulnerabilities within hours, while manual repairs still take days or even weeks.

Black Duck Chief Product and Technology Officer Dipto Chakravarty stated: "The differentiator does not lie in whether AI can produce a fix, but in whether you can trust it. By combining deterministic static analysis with software composition analysis, along with AI-driven traffic diversion, fix generation, and verification, and adding manually defined safeguards and approval thresholds, proxy-based fixes become a solution that enterprises can truly trust and deploy."

Closed-loop process: Scan, divert, repair, verify, submit

Signal Agentic Fix automates the end-to-end repair process; otherwise, this process would be limited by the available manpower and expertise of the team:

• Scan: Utilize the deterministic SAST and SCA engines of Black Duck to identify defects in proprietary code and open-source dependencies on a scaled-out manner, balancing reliability with cost-effectiveness.
• Diversion: Utilize AI to assess the severity, accessibility, and usability, filter out false positives, and prioritize handling of issues with the highest risk.
• Fix: For SAST, a code fix was identified; for SCA, the fix was carried out according to the guidance provided by Black Duck Security Advisories and combined with the dependency upgrade fix from ContextAI ™.
• Verification: Re-scane the fixed code, and optionally run customer-defined compliance checks and functional tests to confirm that the fix does not introduce new defects or vulnerabilities.
• Submission: Each change is routed for manual review and approval, which can be done through the developer's AI coding proxy, or as a pull request submitted within the team's source code management system. Developers always have full control over what enters the code repository.

The result is a higher repair throughput, as well as a significantly shortened exposure window between the discovery of vulnerabilities and the delivery of verified fixes.

Two deployment methods: through AI encoded proxy, or running in the DevOps pipeline.

Signal Agentic Fix for Coding Agents: It can act as a security collaborator, working in parallel with developers and their AI coding agents (such as Claude Code). It initiates SAST and SCA scans on new or existing code, routes the findings for prioritization, and provides issue and fix guidance back to the coding agents, who then implement the repairs. Subsequently, Signal Agentic Fix will perform another scan to verify the results. Since the repairs are carried out by the coding agents, they are subject to the same hooks and skills currently used by the team for code generation. Developers must approve or reject each change before it is applied.

Signal Agentic Fix for DevOps Pipelines: It can be integrated with the existing SCM and CI workflows. The same repair cycle can be triggered upon events such as submission and building, or as needed through the user interface. The repairs will use the configured LLM to generate and verify, and will be submitted in the form of SCM pull requests for team review and approval before being merged.

Built-in safeguards ensure that the team maintains control.

Organizations that use Signal Agentic Fix do not have to choose between repairing machine speed and the governance required by regulated and security-critical industries:

• Configurable repair rules define what proxies are allowed or required to be repaired, as well as how to perform the repairs, which can be set at the project or organizational level.
• Configurable validation rules allow teams to provide coding and compliance standards, additional context, as well as a test suite that each generated fix must meet.
• Manual review in the development process ensures that no changes are made to the code repository without the explicit signature and consent of developers or the team.

Built on verified Black Duck technology

Unlike solutions that rely solely on AI, Signal Agentic Fix integrates the market-leading capabilities of Black Duck into a proxy framework designed specifically for fast, reliable, and verifiable repairs:

• The same deterministic SAST and SCA engines used by Black Duck Polaris ®, Coverity ®, and Black Duck SCA are provided, offering the speed and economy required for enterprise scale.
• Earlier this year, AI SAST Triage and AI SCA Reachability Analysis were launched, which can sort findings by severity and availability, and identify reachable open-source vulnerabilities in any programming language.
• Also launched earlier this year, AI Fix Pull Requests can generate and submit fixes for the issues with SAST and SCA.
• ContextAI, with over 20 years of manually verified application security context, can enhance the accuracy and reliability of analysis and repair based on LLM.

Availability

Starting today, Signal Agentic Fix for Claude Code provides Early Access. In the coming weeks, more encoding proxies and DevOps pipeline integrations will also be launched through Polaris, Coverity, and Black Duck SCA.

For more information, please visit the company's website, read their blog articles, or sign up for their webinars that will be held in North America, EMEA, and APAC.

About Black Duck

Black Duck ® is an application security solution designed for the AI era. The company's approach is inherently hybrid: deterministic analysis provides verifiable results, which serve as a systematic record for governance; AI-driven reasoning prioritizes risks that can be exploited, while proxy-based repairs are completed at machine speed – ensuring that the team's delivery pace matches the speed at which AI code is written, without inheriting the associated risks. Black Duck is trusted by thousands of organizations in some of the world's most demanding industries, including aerospace, defense, automotive, semiconductors, and healthcare, and boasts over 20 years of manually verified vulnerability intelligence. For more information, please visit blackduck.com.