Burlington, Massachusetts, October 27 /PRNewswire/ -- Black Duck®, a leader in application security for the AI era, today announced the launch of Signal Agentic Fix, the latest agent in the Black Duck Signal™ suite. Signal is a set of AI agents designed to minimize human process bottlenecks and help teams secure software faster to keep pace with the surge in vulnerabilities and exploits driven by AI. Signal Agentic Fix combines Black Duck’s industry-leading deterministic static application security testing (SAST) and software composition analysis (SCA) engines with AI-driven triage, fix generation, and validation, ensuring every change undergoes human review before merge.
Black Duck states that Signal Agentic Fix addresses two pressures exacerbated by the rapid adoption of AI in software development. The first is the growing backlog of vulnerabilities, driven by a surge in AI-generated code, its higher vulnerability rate, and a large number of new supply chain CVEs. The second is the dramatically shortened exploitation window: attackers are using AI to chain and weaponize vulnerabilities within hours, while human-led remediation still takes days or even weeks.
Dipto Chakravarty, Chief Product and Technology Officer at Black Duck, said: “The differentiation isn’t whether AI can write fixes—it’s whether you can trust it. Combining deterministic static analysis and software composition analysis with AI-driven triage, fix generation, and validation, along with human-defined guardrails and approval thresholds, is what makes agent-based remediation a solution enterprises can truly trust and deploy.”
Closed-loop process: Scan, route, remediate, verify, submit
Signal Agentic Fix automates the end-to-end repair process, which would otherwise be limited by the team’s available manpower and expertise:
- Scan: Use Black Duck’s deterministic SAST and SCA engines to identify vulnerabilities in proprietary code and open-source dependencies at scale, balancing reliability and cost-effectiveness.
- Traffic routing: Use AI to assess severity, accessibility, and exploitability, filter out false positives, and prioritize the highest-risk issues.
- Fix: Generate code fixes for SAST findings; for SCA findings, follow remediation guidance from Black Duck Security Advisories and use ContextAI™ to generate dependency upgrade fixes.
- Verify: Rescan the fixed code and optionally run customer-defined compliance checks and functional tests to ensure the fix does not introduce new defects or vulnerabilities.
- Submit: Route each change for manual review and approval, either through the developer’s AI coding agent or as a pull request in the team’s source code management system. Developers always maintain full control over what enters the codebase.
This results in higher repair throughput and a significantly reduced exposure window between vulnerability discovery and delivery of verified fixes.
Two deployment methods: via an AI coding agent or running within a DevOps pipeline.
Signal Agentic Fix for Coding Agents: Acts as a secure collaborator, working in parallel with developers and their AI coding agents (e.g., Claude Code). It initiates SAST and SCA scans on new or existing code, triages and prioritizes findings, and provides feedback on issues and remediation guidance to the coding agent, which then implements the fixes. Signal Agentic Fix then rescan to verify the results. Since fixes are executed by the coding agent, they are subject to the same hooks and constraints already in place for the team’s code generation processes, and developers approve or reject each change before application.
Signal Agentic Fix for DevOps Pipelines: Integrates with existing SCM and CI workflows to trigger the same repair cycle upon events such as commits and builds, or on-demand via the user interface. Fixes are generated and validated using a configured LLM, then submitted as SCM pull requests for team review and approval before merging.
Built-in safeguards ensure the team maintains control.
Organizations using Signal Agentic Fix do not have to choose between fixing machine speed and the governance required in regulated and safety-critical industries:
- Configurable repair rules define what the agent is allowed or required to fix and how to fix it, and can be set at the project or organization level.
- Configurable validation rules enable teams to define coding and compliance standards, additional context, and a test suite that each generated fix must satisfy.
- Human-in-the-loop approval ensures that no changes enter the codebase without explicit approval from developers or teams.
Built on proven Black Duck technology
Unlike solutions that rely solely on AI, Signal Agentic Fix integrates Black Duck’s market-leading capabilities into an agent framework designed for fast, reliable, and verifiable fixes:
- Uses the same deterministic SAST and SCA engines as Black Duck Polaris®, Coverity®, and Black Duck SCA, delivering the speed and cost-efficiency required for enterprise-scale operations.
- Earlier this year, we launched AI SAST Triage and AI SCA Reachability Analysis, which prioritize findings by severity and exploitability, and identify reachable open-source vulnerabilities in any programming language.
- Similarly, AI Fix Pull Requests, launched earlier this year, can generate and submit fixes for SAST and SCA issues.
- ContextAI, with over 20 years of human-validated application security context, enhances the accuracy and reliability of LLM-based analysis and remediation.
Availability
Early Access to the Signal Agentic Fix for Claude Code is available today, with additional coding agents and DevOps pipeline integrations coming soon via Polaris, Coverity, and Black Duck SCA.
For more information, visit the company’s website, read its blog posts, or sign up for its upcoming webinars in North America, EMEA, and APAC.
About Black Duck
Black Duck® is an application security solution designed for the AI era. The company’s approach is inherently hybrid: deterministic analysis delivers verifiable results and serves as the authoritative system of record for governance; AI-driven reasoning prioritizes exploitable risks, while agent-based remediation fixes issues at machine speed—enabling teams to keep pace with AI-generated code without inheriting its associated risks. Trusted by thousands of organizations across the world’s most demanding industries—including aerospace, defense, automotive, semiconductors, and healthcare—Black Duck boasts over 20 years of manually validated vulnerability intelligence. Learn more at blackduck.com.