Application security vendor Black Duck has launched Signal Agentic Fix, a new AI agent designed to shrink the gap between vulnerability discovery and a validated fix reaching production.
The agent is the latest addition to Black Duck Signal, the company’s collection of AI agents aimed at removing the human workflow bottlenecks that stop security teams keeping pace with the rising volume of vulnerabilities and exploits.
Black Duck says the launch responds to two pressures that AI has intensified for defenders. The first is a swelling remediation backlog, fuelled by the surge in AI-generated code, the higher vulnerability rates found in that code, and a steady flood of new supply chain CVEs. The second is a collapsing time to exploit: attackers are now using AI to chain and weaponise vulnerabilities in hours, while human-led remediation is still typically measured in days or weeks.
Scan, triage, fix, validate, submit
Signal Agentic Fix automates the full remediation loop:
- Scan: Black Duck’s deterministic SAST and SCA engines – the same ones behind Polaris, Coverity and Black Duck SCA – identify defects in proprietary code and open source dependencies.
- Triage: AI assesses severity, reachability and exploitability, filtering out false positives and prioritising the highest-risk issues.
- Fix: AI generates code fixes for SAST findings, while SCA findings receive dependency upgrade fixes based on Black Duck Security Advisories, informed by the company’s ContextAI knowledge base.
- Validate: Fixed code is re-scanned and can optionally be run against customer-defined compliance checks and functional tests to confirm no new defects have been introduced.
- Submit: Every change is routed to a human for review, either via the developer’s AI coding agent or as a pull request in source control.
“The differentiator is not that AI can write a fix; it’s whether you can trust it,” said Dipto Chakravarty, Chief Product & Technology Officer at Black Duck. “A harness that pairs deterministic static and software composition analysis with AI-powered triage, fix generation, and validation, plus human-defined guardrails and approval gates is what makes agentic remediation something enterprises can actually trust and deploy.”
Two deployment models
The agent can work as a security collaborator alongside a developer and their AI coding agent, such as Claude Code. In this mode, Signal Agentic Fix runs the scans and triage, passes findings and fix guidance to the coding agent to implement, then re-scans to validate the result. Because the coding agent makes the change, it is governed by the same hooks and skills a team already uses for code generation.
Alternatively, it can sit in the DevOps pipeline, triggering the remediation loop on commits, builds or on demand, generating fixes with a configured LLM and submitting them as pull requests for team approval.
For organisations in regulated and safety-critical sectors, Black Duck has built in configurable remediation rules governing what the agent may fix and how, validation rules that let teams apply their own coding and compliance standards and test suites, and mandatory human-in-the-loop approval before anything is merged.
Availability
Signal Agentic Fix for Claude Code is available in Early Access now, with further coding agent and DevOps pipeline integrations across Polaris, Coverity and Black Duck SCA due in the coming weeks.
