Patrick Carey, vice president of product marketing for Black Duck, said the Signal Agentic Fix agent leverages the company’s static application security testing (SAST) and software composition analysis (SCA) engines to provide a harness that discovers vulnerabilities in proprietary code and open source dependencies, and then validates any fixes the AI agent generates. The fixes themselves are generated using either AI models made available by Black Duck or a supported model that DevSecOps teams prefer to invoke, said Carey. Also, rules can be configured to define what the agent is allowed or required to fix and how to do it.
Those rules can also be used to establish coding and compliance standards that the AI agent must follow. Any generated fix is then rescanned to confirm that it does not introduce new defects or vulnerabilities.
