devopsy.kinsta.cloud

Author: Mike Vizard

Legit Security Extends AI Reach of ASPM Platform

Legit Security at the 2025 RSA Conference today extended the reach of its application security posture management (ASPM) platform that leverages artificial intelligence (AI) to identify vulnerabilities and other weaknesses to now include suggestions for remediating issues in code.

The company has also extended its existing discovery capabilities to now include AI models that are part of the software supply chain, while simultaneously infusing AI capabilities into its risk assessment capability to provide severity rankings of potential threats.

Legit Security CTO Liav Caspi said, in effect, the ASPM platform assigns AI agents to perform these and other tasks using an AI agent that has been trained to orchestrate a DevSecOps workflow. Longer term, Legit Security also plans to add support for the Model Context Protocol (MCP), an emerging de facto standard for integrating AI agents across multiple platforms.

The Legit ASPM platform is designed to provide DevSecOps teams with a complete view of the entire software development lifecycle, including assets, owners, security controls, vulnerabilities, and the impact they are having on developer productivity. It uses AI to correlate scans and run code analysis to reduce false positives while at the same time making it simpler to discover secrets that have been inadvertently embedded in code.

That approach makes it possible to, for example, integrate those agents to suggest code changes as the time pull-request checks are made, noted Caspi. The overall goal is to reduce the current amount of manual effort required to discover and remediate vulnerabilities that today are rife across software supply chains, he added.

While a lot of progress has been made in terms of adopting best DevSecOps practices, most application development teams are not entirely sure how many artifacts with known vulnerabilities are being incorporated into software builds. Hopefully, those issues will be discovered before an application is deployed in a production environment, but the earlier they are discovered, the less costly they are to fix. The challenge is finding a way to accurately identify these issues in a way that application developers will embrace. All too often, application developers will turn off legacy code scanning tools simply because the number of alerts being generated becomes overwhelming.

At this point, it’s not so much a question of whether AI agents will be incorporated into DevSecOps workflows so much as it is to what degree. Many of the code review tasks that could be assigned to AI agents are not elements of the software development cycle that most humans, especially, enjoy performing. Just as importantly, every vulnerability remediated before an application is deployed is one less fix an application developer is going to be asked to make weeks, sometimes, even months, after they have moved on to another project.

Eventually, there will, thanks to the rise of AI, come a day when shipping code with known vulnerabilities will be widely considered unacceptable. The sooner DevSecOps teams start working toward achieving that goal, the better off everyone affected by the current state of application security will become.

April 29, 2025
Lineaje Leverages AI Agents to Secure Open Source Packages and Images

Lineaje has added artificial intelligence (AI) agents that leverage multiple types of code scanners to ensure the open-source software packages and artifacts being used by application developers are truly secure.

Company CEO Javed Hasan said the Gold Open Source Packages and Gold Open Source Images are curated by AI agents trained to automate tasks based on data collected by a software composition analysis (SCA) platform, dubbed SCA360.

SCA360 also provides access to a Deep Dependency and Reachability Scanner to identify mandatory and optional dependency chains and their inherent risks. That scanner is coupled with a static code analysis engine that detects reachable vulnerabilities and linked functions to surface insights into transitive dependencies. Finally, a malware Scanner detects embedded malicious and tampered packages, highlighting those of dubious origin.

Using those scanners, the Gold Open Source Images services provide software engineering teams with a catalog of over 2,000 vulnerability-free images. The Gold Open Source Packages similarly ensures that more than three million open source packages are free of known vulnerabilities by tracking more than 100 attributes for each package and its transitive dependencies. In total, Lineaje is now using AI to track more than 408 billion open-source security data points, including vulnerabilities, licenses, geo-provenance, maintainability, code quality and contributors.

Lineaje AI agents can compare versions of packages and images to generate compatibility analysis, which the AI agents then use to continuously scan source code repositories, detect security issues, find updates for direct dependencies in the source code and remediate them, said Hasan. In effect, open source software can now become self-healing, he added.

Additionally, those AI agents will highlight any known issues with existing application environments, said Hasan.

Finally, application developers can also generate custom Gold Images on demand by specifying an existing public container image. Lineaje AI will then automatically create a compatible, hardened Gold Image that is added to all Gold Open Source Image subscriptions.

Lineaje will also continue to provide existing manual services for application development teams, including providing security updates to older generations of open source packages and images that DevOps teams, for one reason or another, can’t update without breaking an application.

While a lot of progress has been made in terms of adoption of best DevSecOps practices, there is still plenty of room for improvement, given the number of vulnerabilities and other issues being discovered either in production environments or just before an application is supposed to be deployed. One way to achieve that goal is to, of course, ensure the software artifacts that developers rely on to build those applications are, from a cybersecurity perspective, as pristine as possible.

In the meantime, DevSecOps teams would be well advised to encourage developers to not, whenever possible, rely on images and packages that have not been somehow certified. It’s not that any developer starts out to build an insecure application, but rather for there to be a laissez-faire tendency to grab the first image or package at hand that looks like it might fit their purpose.

April 29, 2025
Minimus Unfurls Service for Accessing Secure Software Artifacts

Minimus today at the 2025 RSA Conference launched a managed service through which it ensures application development teams are provided access to a secure set of minimal container images and virtual machines.

Company CTO John Morello said the Minimus service eliminates the possibility that developers might inadvertently download software artifacts that might be infested with malware.

At the core of the Minimus service is an operating system the company specifically developed to make managing the orchestration of software artifacts simpler. That capability then enabled Minimus to ensure that hardened software artifacts that have been configured to minimize the overall size of the attack surface that might be presented can be integrated into DevSecOps workflows, said Morello.

Minimus also constantly monitors threat intelligence to ensure the security of those artifacts while also providing developers with real-time insights into potential threats to reduce overall risk, he added.

While a lot of progress has been made in securing software supply chains, too many developers are still downloading software artifacts from insecure repositories. The Minimus service provides an alternative approach to accessing software artifacts that have been vetted by application security experts for known vulnerabilities and security weaknesses, said Morello.

It’s not clear why more DevSecOps teams are not limiting the number of repositories that application developers can use to download software artifacts but cybercriminal syndicates have clearly become more adept at injecting malware into them as part of an effort to infect as many downstream applications as possible. Unfortunately, it might not be years before that malware is actually activated.

DevSecOps teams have been making a concerted effort to provide application developers with scanning tools that discover vulnerabilities and malware in software artifacts. However, the success of those efforts is often limited simply because the number of alerts being generated overwhelms the ability of application developers to recognize and remediate issues based on their actual severity. The Minimus service reduces the need to run those scans by ensuring the software artifacts being used are secure in the first place, said Morello.

It’s not clear how many application security incidents can be traced specifically back to vulnerabilities and malware in software artifacts, but most developers would prefer to not have to address an issue discovered months, sometimes even years, after an application has been deployed in a production environment. As always, an ounce of prevention is always going to be worth more than a pound of any proverbial cure.

The challenge at this point isn’t so much finding the technologies required to secure those artifacts as much as it might be changing the culture of application developers that have for decades now routinely downloaded artifacts from public repositories without considering the application security implications.

Hopefully, the overall state of application security will improve as more organizations move to lock down their software supply chains. In the meantime, however, DevSecOps teams rather than investing in more tooling may want to consider trying to solve the issue at the root source of the repository problem.

April 28, 2025
Five Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration.

Dice.com

Citi
Rutherford, NJ
Senior Vice President – Technology Infrastructure/DevOps Lead
$176,720 to $265,080

Indeed.com

NVIDIA
Holmdel, NJ
Senior DevOps Infrastructure Engineer
$168,000 to $333,500

SimplyHired.com

Toyota
Plano, TX
Senior DevOps Software Engineer
$121,000 to $179,000

The Job Network

InVita Healthcare Technologies
Baltimore, MD
DevOps Engineer
$115,000 to $125,000

LinkedIn

Madison Square Garden Entertainment Corp
New York City
Senior DevOps Engineer
$113,000 to $190,000

April 28, 2025
Cycode Adds AI Agent Teammates to Secure Software Supply Chains

Cycode, this week, added multiple artificial intelligence (AI) agents to its application security posture management (ASPM) capable of monitoring code and offering remediation suggestions.

In addition, the company is adding an ability to, in real-time, monitor continuous integration processes running in memory. That capability makes it possible to thwart, for example, recent attacks that exploited tj-actions files to compromise continuous integration/continuous delivery (CI/CD) infrastructure and developer credentials.

Amir Kazemi, director of product marketing for Cycode, said collectively these capabilities will enable DevSecOps teams to streamline workflows in a way that reduces the friction and chaos many of these teams currently encounter.

The agents being added between now and June to the Cycode platform, dubbed AI Agents, tap directly into a Risk Intelligence Graph (RIG) developed by Cycode to surface, for example, issues involving code repositories, workflows, secrets, dependencies and cloud infrastructure assets.

There is also a Change Impact Analysis Agent that monitors code changes across pull requests to identify material changes that significantly alter risk posture.

Finally, there is an Exploitability Agent that invokes the static application security testing (SAST) and source code analysis (SCA) scanning tools embedded in the Cycode platform, the results of which can be passed on to a Fix & Remediation Agent that analyzes the root cause of an issue to suggest code fixes that align with frameworks and the coding patterns variable naming patterns being used by application development teams.

That ability to share data and context between agents is enabled by the Model Context Protocol (MCP), an emerging de facto standard integration framework for AI agents that was originally developed by Anthropic. MCP essentially functions as an operating system for AI agents, said Kazemi.

Longer term, Cycode also plans to leverage the agentic AI framework it has developed to build additional agents that can be assigned additional tasks, he added.

It’s not clear how rapidly DevSecOps teams are taking advantage of AI tools to improve application security, but as these technologies mature, there is a clear opportunity to improve application security without having to rely as much on cybersecurity teams to discover vulnerabilities in production environments that they hope application developers will have the time and expertise needed to fix. Instead, most issues will, hopefully, be surfaced and addressed long before that code is deployed.

The challenge, of course, will be not only finding the funding needed to acquire these AI tools, but also adjusting workflows to incorporate them. Many application development teams are relying on DevOps pipelines to build notoriously fragile applications. Improving the security of the software supply chain, however, may present an opportunity to address those issues and more as organizations look to securely deploy more applications at scale.

Regardless of motivation, there might soon come a day when deploying software that has known vulnerabilities becomes truly inexcusable when there is a cadre of AI agents standing at the ready to ensure only the code of the highest quality ever makes it into a production environment.

April 24, 2025
Feature Management’s Role in DevOps with Trevor Stuart

Trevor Stuart, general manager and senior vice president of Harness, explains how feature management is becoming a critical extension of DevOps workflows a year after the acquisition of Split Software.

Feature management is fast becoming a critical pillar in modern DevOps workflows, especially as organizations seek to keep up with the rising volume and velocity of software development. Stuart discusses how the evolution of feature flags has reshaped deployment practices and the expectations of software delivery teams.

The core value of feature flags lies in their ability to enable safer, faster releases. They give teams the flexibility to toggle functionality without redeploying code, making it possible to mitigate risk during production rollouts. Initially used sparingly and often managed via manual config files, feature flags are now a mainstream method for progressive delivery. They help organizations validate features with specific user segments, reduce blast radius when issues arise, and support experimentation in real-world conditions.

Stuart highlights that the growing use of AI-generated code, modular microservices, and increasing product personalization have only amplified the need for robust feature flag systems. These tools now serve not just as toggles, but as real-time control layers for dynamic configuration, adaptive experimentation, and telemetry-based feedback. Companies are increasingly using them to fine-tune AI models, personalize customer experiences, and refine software quality using real-time performance data.

Despite broad awareness, many teams still rely on homegrown or brittle solutions, leading to maintenance issues and outages. The challenge is often organizational: determining whether to build, buy, or integrate these capabilities into broader CI/CD pipelines. Stuart argues that deeply integrating feature flagging into delivery workflows—particularly as part of a unified platform—is essential for scale and consistency.

As software complexity grows, so does the need for intelligent automation. Stuart envisions pipelines that not only deploy features but also observe impact, run experiments, adapt based on results, and even feed signals back into models. It’s a shift from manual gates to data-driven automation, marking a pivotal transition in how DevOps teams manage risk, velocity, and innovation.

April 23, 2025
Endor Labs Adds AI Agents to Automate Application Security Reviews

Endor Labs today added a set of artificial intelligence (AI) agents to its platform, specifically trained to identify security defects in applications and suggest remediations.

Fresh off raising an additional $93 million in funding, Endor Labs founder and CEO Varun Badhwar said going beyond simply identifying vulnerabilities in code, these AI agents are trained to assess the architecture of an application for security flaws, along with suggestions for improving security.

Those AI agents have been trained using both the data that Endor Labs collects from its code scanning tools and the software engineering expertise provided by its internal research and development teams, he added.

Specifically, Endor Labs has spent more than three years analyzing 4.5 million open source projects and AI models, mapping more than 150 risk factors, building call graphs to index billions of functions and libraries and annotating exact lines of code where known vulnerabilities exist.

That level of context enabled Endor Labs to build multiple agents to function as application developers, architects and security engineers that work in concert with one another to analyze applications at their most fundamental architectural level, said Badhwar. Those agents are, for example, able to review every pull request (PR) for architectural changes that might impact application security, he added.

That approach also enables Endor Labs to set up guardrails that ensure the AI agents it has developed generate accurate outputs that application developers can trust, noted Badhwar. Additionally, Endor Labs is also adding support for a Model Context Protocol (MCP) plugin for the AI coding tools developed by Cursor, along with existing support for GitHub Copilot coding tools

That level of integration is critical because, as application developers increasingly embrace AI tools to write code, the number of applications that DevSecOps teams will need to review before they are deployed is about to exponentially increase, said Badhwar. Much of that code, however, contains vulnerabilities simply because the AI tools creating it were trained using samples of code randomly collected from across the Internet, much of which is inherently flawed, he added.

The only way DevSecOps teams will be able to keep pace with the rate of application development and deployment is to employ AI agents capable of identifying issues as code is being created, said Badhwar.

It’s not clear at what pace DevOps teams are embracing AI tools to write code that actually finds its way into a production environment, but a Futurum Research survey finds 41% of respondents expect generative AI tools and platforms will be used to generate, review and test code. The challenge, of course, is that the more code generated using those tools, the more likely it becomes that application security issues will arise.

Hopefully, AI will, in effect, be relied on more to secure the code being created by both machines and humans, both before and, when needed, after it is deployed. There is a clear opportunity to apply AI to reduce the massive amount of security debt that exists in legacy applications, noted Badhwar. In the meantime, however, DevSecOps teams would be well advised to review the quality of the code being generated by these tools before any security incident inevitably occurs.

April 23, 2025
Veracode Extends Scope and Reach of DevSecOps Portfolio

Veracode today updated its risk management tool to provide integration with Kubernetes runtime environments, increased integration with code repositories to make it simpler to identify the origin of vulnerabilities and, available shortly, an ability to add tags and classifications to help streamline remediation efforts.

In addition, Veracode is now providing early access to Veracode Package Firewall, which makes use of Open Policy Agents (OPA) to enforce policies that prevent the usage of open source software dependencies that have known vulnerabilities using technology the company gained with the acquisition of Phylum earlier this year. It is scheduled to become generally available in June.

Derek Maki, VP product and GM at Veracode, said both additions to the company’s portfolio will enable DevSecOps teams to better secure software supply chains at a time when they are increasingly being targeted by cybercriminals who have developed coding expertise.

The latest extensions to Veracode Risk Manager (VRM), for example, now makes it possible to provide more real time context about threats in container applications both before and after they have been deployed in a runtime environment as part of a larger effort to improve application security posture management (ASPM), he noted.

While a lot of progress has been made in terms of adopting best DevSecOps practices, there remains much work to be done, noted Maki. There has been too much emphasis on shifting responsibility for application security solely onto the shoulders of application developers, he added. Instead of shifting that responsibility as far left as possible to application developers, organizations need a more balanced approach that makes it easier to, for example, identify vulnerabilities in production environments that are actually exploitable, Maki said.

Otherwise, cybersecurity teams wind up creating long lists of vulnerabilities for application developers to investigate that, in the final analysis, reduce the amount of time they have available to write additional code, he added.

Unfortunately, many DevSecOps teams are now trying to analyze data being generated by, on average, 45 different tools that are being employed across multiple silos within their organization, said Maki. The end result is an overwhelming amount of telemetry data that is too difficult for DevSecOps teams to analyze in any meaningful way with a tool such as VRM, he added.

Each organization will need to determine how best to apply limited DevSecOps resources as they best see fit, but the one certain thing is the amount of code moving through their pipelines is only going to exponentially increase in the age of generative artificial intelligence (AI). Not all that code will make it into a production environment, but it will need to be tested for vulnerabilities that could be introduced at multiple points of the software development lifecycle (SDLC).

The challenge, as always, is finding a way to eliminate as many issues as early as possible without inundating application developers who are not cybersecurity experts with a stream of alerts that, because they are not likely to comprehend, will simply be ignored.

April 22, 2025
Five Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration.

LinkedIn

Harnham
Atlanta
Cloud/DevSecOps Engineer
$170,000 to $190,000

Dice.com

Oscar Technology
Remote
DevOps Engineer
$150,000 to $180,000

SimplyHired.com

Tesla
Palo Alto, CA
DevOps Engineer – Vehicle Software
$133,440 to $292,800

Indeed.com

OtherSide Entertainment
Concord, MA
Senior DevOps Engineer
$125,500 to $155,000

The Job Network

Sharetec
Fort Wayne, IN
DevOps Manager
$110,000 to $130,000

April 21, 2025
GitLab and AWS Deliver on Generative AI Integration Promise

GitLab this week made generally available a version of its generative artificial intelligence (AI) framework for software development that includes AI agents developed by Amazon Web Services (AWS).

David DeSanto, chief product officer at GitLab, said GitLab Duo with Amazon Q gives organizations that are building applications on the AWS cloud the ability to create more tightly integrated DevOps workflows using both AI frameworks.

Amazon Q Developer is a set of AI agents that AWS has developed using the same framework it used to create Amazon Q Business, a set of AI agents capable of automating tasks across a wide range of business workflows.

The integration with Amazon Q Developer will enable DevOps teams to integrate a set of AI agents designed to be used primarily by application developers with a set of generative AI capabilities that GitLab is providing across the entire software development lifecycle, said DeSanto.

Collectively, that integration will make it simple to, for example, analyze requirements, plan implementations and generate merge requests. They can also be used to identify the root cause of a vulnerability, align with surfacing code to remediate it and review code.

Additionally, AI agents can also accelerate the process of updating legacy code bases to a more current version of a programming language.

It’s not clear how widely generative AI is being applied to software engineering, but a Futurum Research survey finds 41% of respondents expect generative AI tools and platforms will be used to generate, review and test code. Many developers are already clearly using these tools to generate code, but many have also found it challenging to debug code they didn’t write simply because they don’t understand how it was constructed.

Many software engineering teams are also discovering that because AI coding tools were not exposed to the unique attributes of the platforms being used to deploy the code they create, it won’t run without being reworked by a human developer.

There is little doubt that AI tools won’t be relied on to automate a range of tasks, but some care needs to be taken to understand when and how best to apply them, said DeSanto. Generative AI tools are, by definition, probabilistic in the sense that they generate output based on their ability to guess the right answer. Many DevOps workflows, however, are deterministic in that they need to be completed the same way every time, he noted.

The challenge then becomes determining which use cases make the most sense for using AI tools rather than simply applying AI for the sake of AI, said DeSanto.

Ultimately, AI tools will be a boon to software engineering in that many of the manual tasks that today make software development more tedious than anyone cares for will be eliminated. The thing that remains to be seen is how AI agents might soon take advantage of the reasoning engines built into the next generation of large language models (LLMs) to automate not just specific tasks but potentially entire workflows.

April 19, 2025