Black Duck has introduced Signal Agentic Fix, a new AI-powered agent designed to automate vulnerability remediation while ensuring developers retain control over changes made to their codebases.
The solution is the latest addition to Black Duck Signal, a collection of AI agents developed to reduce manual bottlenecks in application security workflows. Signal Agentic Fix integrates deterministic static application security testing (SAST) and software composition analysis (SCA) with AI-driven vulnerability triage, automated fix generation, and validation. Every proposed change must undergo human review before being merged into the codebase.
The launch addresses two growing challenges in software security. The increasing use of AI-generated code, combined with rising vulnerability rates and a continuous influx of software supply chain CVEs, is contributing to expanding remediation backlogs. At the same time, attackers are leveraging AI to identify, combine, and exploit vulnerabilities within hours, significantly narrowing the window available for defensive action.
“The differentiator is not that AI can write a fix; it’s whether you can trust it,” said Dipto Chakravarty, Chief Product & Technology Officer at Black Duck. “A harness that pairs deterministic static and software composition analysis with AI-powered triage, fix generation, and validation, plus human-defined guardrails and approval gates is what makes agentic remediation something enterprises can actually trust and deploy.”
Signal Agentic Fix is designed to streamline the complete vulnerability remediation lifecycle, from initial detection through validation and submission for developer approval.
The process begins with Black Duck’s deterministic SAST and SCA engines, which identify security weaknesses in proprietary source code and open source dependencies. AI-powered triage then evaluates findings based on severity, reachability, and exploitability, helping security teams eliminate false positives and concentrate on vulnerabilities presenting the greatest risk.
For SAST findings, the agent generates code-level corrections using AI. For SCA findings, it recommends dependency upgrades based on remediation guidance from Black Duck Security Advisories, supported by ContextAI.
Following remediation, Signal Agentic Fix performs additional scans to verify the changes and identify any newly introduced vulnerabilities or defects. Organizations can also incorporate their own compliance checks and functional testing requirements into the validation process.
Once validation is complete, proposed fixes are submitted for human review through the developer’s AI coding agent or as pull requests within the organization’s source control system. This approval process ensures that developers maintain authority over modifications introduced into production code.
By automating these activities, Black Duck aims to increase remediation capacity and reduce the period between vulnerability discovery and delivery of a validated fix.
Signal Agentic Fix supports two deployment approaches, allowing organizations to integrate automated remediation into existing development environments.
Signal Agentic Fix for Coding Agents operates alongside developers and AI coding assistants such as Claude Code. The agent performs SAST and SCA scans against new or existing code, assesses findings, and provides remediation guidance to the coding assistant responsible for implementing the proposed changes.
After the coding agent applies a fix, Signal Agentic Fix conducts another scan to confirm the results. Because remediation is performed through the existing coding assistant, changes remain subject to the team’s established hooks, skills, and development controls. Developers must approve or reject modifications before they are applied.
Signal Agentic Fix for DevOps Pipelines integrates with existing source code management (SCM) and continuous integration (CI) workflows. Organizations can initiate remediation automatically through events such as commits and builds or manually through a user interface.
In this deployment model, a configured large language model generates fixes, which are subsequently validated and submitted as SCM pull requests for review before merging.
Black Duck has also incorporated configurable governance controls to support organizations operating in regulated and safety-critical industries.
Security and development teams can establish remediation policies defining which vulnerabilities the agent is permitted or required to address, along with the methods it must follow. These rules can be configured at the project or organizational level.
Additional validation policies allow organizations to specify coding standards, compliance requirements, contextual information, and testing procedures that generated fixes must satisfy.
Human-in-the-loop approval remains a central requirement, preventing the agent from introducing changes into the codebase without explicit authorization from a developer or designated team.
The technology combines several established Black Duck application security capabilities within a unified agentic remediation framework.
Its scanning functionality uses the deterministic SAST and SCA engines underlying Black Duck Polaris, Coverity, and Black Duck SCA, providing the analysis capabilities needed for enterprise-scale vulnerability detection.
Signal Agentic Fix also incorporates AI SAST Triage and AI SCA Reachability Analysis, technologies introduced earlier in 2026 to help organizations prioritize security findings according to severity and exploitability. These capabilities include identifying reachable vulnerabilities in open source components across programming languages.
The solution builds on AI Fix Pull Requests, which automate the generation and submission of fixes for SAST and SCA findings.
ContextAI provides additional support through more than two decades of curated application security knowledge, helping improve the accuracy and reliability of LLM-based vulnerability analysis and remediation.
Signal Agentic Fix for Claude Code is currently available in Early Access. Black Duck plans to introduce additional coding agent and DevOps pipeline integrations across Polaris, Coverity, and Black Duck SCA in the coming weeks.
Organizations can find additional information on the Black Duck website, read the company’s blog post, or register for upcoming webinars covering North America, EMEA, and APAC.
________
About Black Duck
Black Duck® is application security for the AI era. Our approach is hybrid by design. Deterministic analysis delivers verifiable results and serves as the system of record for governance, while AI-powered reasoning prioritizes what’s exploitable and agentic remediation fixes it at machine speed – so your team ships as fast as AI writes code, without inheriting the risk that comes with it. Trusted by thousands of organizations in many of the world’s most demanding industries, including aerospace, defense, automotive, semiconductor, and healthcare, and backed by more than 20 years of human-verified vulnerability intelligence.
Learn more at blackduck.com.
Join our LinkedIn group Information Security Community!
