devopsy.kinsta.cloud

Category: Features

ArmorCode Makes Anya AI Agent Generally Available

ArmorCode at the 2025 RSA Conference this week made generally available Anya, an artificial intelligence (AI) agent added to its application security posture management (ASPM) platform that has specifically been trained to augment DevSecOps teams.

Karthik Swarnam, chief security and trust officer of ArmorCode, said Anya is based on a large language model (LLM) that has been trained to identify existing and emerging risks data collected via more than 285 integrations with security tools, multiple sources of code and IT infrastructure platforms.

Anya then uses that data to deduplicate and correlate actionable insights surfaced in natural language to enable DevSecOp teams to prioritize remediation steps by severity, fixability and team ownership, he added.

Additionally, Anya leverages retrieval-augmented generation (RAG) techniques with every query and interaction to continuously fine-tune results based on the data exposed to the LLM.

The overall goal is to provide an easily accessible software-as-a-service (SaaS) platform that dramatically reduces the number of false positives that existing application security tools and platforms currently generate, he noted.

It’s not clear how many organizations have adopted an ASPM platform yet, but a survey of 51 senior security leaders of the Purple Book Community (PBC) fielded by ArmorCode finds more than three-quarters (76%) now view ASPM as their top investment focus for 2025.

A full 86% are already using or exploring generative AI tools in their security programs, and just under two-thirds (65%) also noted they believe AI technologies will reshape application security workflows.

Overall, software supply chain vulnerabilities were noted as the most significant enterprise application threat (84%) followed closely by open-source software risks and cloud misconfigurations at (73%).

Managing the sheer volume of vulnerabilities and false positives was identified as the biggest challenge in securing code (78%), followed by the speed of software development outpacing security priorities (71%) and lack of visibility across application security tools (65%).
In response, 64% report they are growing their application security teams, with 84% noting the role of the AppSec leader is now more important than it was two to three years ago. In total, 92% report that insecure code has become a bigger concern.

There is, of course, at this point no shortage of ASPM platforms that make it simpler to address DevSecOps issues in a way that minimizes disruptions to existing workflows. The one certain thing is that in the age of AI, the volume of code that is likely to have known vulnerabilities is only going to increase exponentially. Most of the tools generating that code have been trained using examples of code that have known vulnerabilities that can randomly surface in any of the output generated by an LLM and far too much of it, despite best intentions, is still likely to find its way into a production environment, said Swarnam.

Longer term, there may come a day when AI results in code that has been reviewed for security flaws long before it ever makes it into a production environment. In the meantime, however, DevSecOps might want, in the short term, to prepare for the worst while still hoping for the best.

May 2, 2025
AI Native Dev: Shaping the Future of AI-First Software Development
In an era where artificial intelligence is rapidly transforming the software development landscape, a new community has emerged to lead this evolution: AI Native Dev. The community is centered around the website, https://AINativeDev.io/, The site serves as a platform for a raft of different types of content and information.

This platform is not just a repository of tools and insights though; it’s a vibrant hub for developers dedicated to reimagining software creation through an AI-first lens.

I recently had a chance to sit down with my friend Patrick Debois, of DevOps fame who is a prominent member of this budding community. You can listen to my DevOps Chats podcast with Patrick for more color and details.

What is AI Native Dev?

AI Native Dev is a collaborative initiative that brings together developers, technologists and thought leaders to explore and define the principles of AI-native software development. Unlike traditional AI-assisted development, which integrates AI tools into existing workflows, AI Native Dev advocates for a foundational shift. It emphasizes building software with AI as a core component from the ground up, fundamentally altering how applications are conceived, designed, and maintained.

The community is spearheaded by industry veterans, including Guy Podjarny, founder of Tessl and former CEO of Snyk, and Simon Maple, a seasoned developer advocate. Their combined expertise in security, development, and AI positions AI Native Dev as a leading voice in the AI-driven development movement.

Beyond GuyPo and Simon Maple, other members of the community include Patrick Debois, Olivier Pomel, Macey Baker and Amanda Brock.

Core Principles of AI Native Development

At the heart of AI Native Dev are four guiding principles that encapsulate the ethos of AI-first software engineering:
1. Specification-Driven Development: Emphasizing clear, structured specifications that serve as the foundation for AI-generated code. This approach ensures that AI tools can produce accurate and contextually relevant codebases.
2. Context-Aware Development: Leveraging AI’s ability to understand and integrate comprehensive project contexts, leading to more informed decision-making and cohesive software solutions.
3. AI Agents as Developers: Transitioning AI from a supportive role to an active participant in software creation, where AI agents can autonomously develop and operate components of software systems.
4. Human Oversight by Design: Ensuring that AI-driven workflows are designed with clear human oversight mechanisms, maintaining alignment with human intent and ethical standards.
These principles are not static; AI Native Dev encourages community contributions to refine and evolve these guidelines, fostering a dynamic and inclusive development philosophy.

Engaging with the Community

AI Native Dev offers multiple avenues for engagement, catering to a diverse range of interests and expertise:
- Discord Community: A space for real-time discussions, knowledge sharing, and networking with like-minded developers passionate about AI-native development.
- AI Native Dev Podcast: Hosted by Guy Podjarny and Simon Maple, the podcast delves into the nuances of AI-native development, featuring conversations with industry leaders and innovators.
- AI Native DevCon: An annual virtual conference that showcases practical applications of AI in software development, offering insights into current trends and future directions.
- AI Dev Tooling Landscape: A comprehensive, community-curated repository of AI tools and technologies spanning the entire software delivery lifecycle, from prototyping to deployment.
These platforms collectively serve as a nexus for learning, collaboration, and innovation, empowering developers to stay at the forefront of AI-native methodologies.

The Vision Ahead

AI Native Dev is more than a community; it’s a movement aimed at redefining the paradigms of software development in the age of AI. By fostering a culture of openness, collaboration and continuous learning, AI Native Dev aspires to equip developers with the tools, knowledge and mindset necessary to harness AI’s full potential.

As AI continues to evolve, so too will the practices and principles of software development. AI Native Dev stands as a beacon for those ready to embrace this transformation, offering a roadmap for building software that is not only enhanced by AI but fundamentally rooted in it.

Join the AI Native Dev Community

Embark on your journey into AI-native software development by exploring the resources and connecting with the community at AINativeDev.io. Whether you’re a seasoned developer or new to the field, AI Native Dev welcomes all who are eager to shape the future of software development through the lens of artificial intelligence.
May 1, 2025
LaunchDarkly Acquires Highlight to Bring Observability to Application Release Management

LaunchDarkly is looking to bring observability to feature flag management by acquiring Highlight, a provider of an open-source application monitoring tool.

Highlight led the development of a namesake observability that enables the detection, tracking, alerting and analysis of logs and traces in real time, in addition to providing a high-fidelity session replay capability.

LaunchDarkly, meanwhile, has developed a Guarded Releases capability that enables DevOps teams to monitor key metrics while progressively rolling out new features. That capability makes it simpler to catch regressions and automatically roll back releases before updates are deployed.

Company CEO Dan Rogers said that when that capability is integrated into a feature management platform, DevOps teams will gain deeper visibility into the impact any recent changes may have had on an application. That’s critical, because it’s usually the most recent change to an application that has created an issue that might, for example, have resulted in an application suddenly becoming unavailable, he added.

As the number of updates to applications continues to increase in the age of artificial intelligence, DevOps teams are going to require observability capabilities that are embedded within the same platform they are using to manage application releases, noted Rogers. Otherwise, they will soon be overwhelmed by the tsunami of code AI tools are now starting to generate, he added.

DevOps teams have, of course, been to varying degrees to help manage the development of new features since the 1970s. LaunchDarkly provides a software-as-a-service (SaaS) platform that makes it easier to isolate the development of any given feature into a branch that can be worked on and tested without impacting the entire application.

At the core of that capability are what are known as feature flags, also known as feature toggles or feature switches, that make it possible to dynamically turn services on or off based on who is accessing them. Rather than being limited to the application development process, those feature flags are now being employed in production environments to enable the continuous delivery of multiple types of digital services to various classes of users of an application. A feature flag management platform enables an organization to keep track of all the flags being employed to keep the overall application environment consistent.

That capability provides application development teams with a way to experiment with adding new capabilities in a way that is much less disruptive. When a feature is completed, that branch is then usually merged into the primary build or can be deployed as a microservice.

More recently, however, feature flags are also being used in production environments to make certain capabilities available to a limited number of end users who might be willing to pay extra to access them.

Regardless of motivation, the role feature flags play in DevOps workflows has greatly expanded. The challenge and the opportunity now is to leverage those feature flags to more progressively manage application rollouts and updates in a way that ensures the best end-user experience possible is being consistently provided.

April 30, 2025
Legit Security Extends AI Reach of ASPM Platform

Legit Security at the 2025 RSA Conference today extended the reach of its application security posture management (ASPM) platform that leverages artificial intelligence (AI) to identify vulnerabilities and other weaknesses to now include suggestions for remediating issues in code.

The company has also extended its existing discovery capabilities to now include AI models that are part of the software supply chain, while simultaneously infusing AI capabilities into its risk assessment capability to provide severity rankings of potential threats.

Legit Security CTO Liav Caspi said, in effect, the ASPM platform assigns AI agents to perform these and other tasks using an AI agent that has been trained to orchestrate a DevSecOps workflow. Longer term, Legit Security also plans to add support for the Model Context Protocol (MCP), an emerging de facto standard for integrating AI agents across multiple platforms.

The Legit ASPM platform is designed to provide DevSecOps teams with a complete view of the entire software development lifecycle, including assets, owners, security controls, vulnerabilities, and the impact they are having on developer productivity. It uses AI to correlate scans and run code analysis to reduce false positives while at the same time making it simpler to discover secrets that have been inadvertently embedded in code.

That approach makes it possible to, for example, integrate those agents to suggest code changes as the time pull-request checks are made, noted Caspi. The overall goal is to reduce the current amount of manual effort required to discover and remediate vulnerabilities that today are rife across software supply chains, he added.

While a lot of progress has been made in terms of adopting best DevSecOps practices, most application development teams are not entirely sure how many artifacts with known vulnerabilities are being incorporated into software builds. Hopefully, those issues will be discovered before an application is deployed in a production environment, but the earlier they are discovered, the less costly they are to fix. The challenge is finding a way to accurately identify these issues in a way that application developers will embrace. All too often, application developers will turn off legacy code scanning tools simply because the number of alerts being generated becomes overwhelming.

At this point, it’s not so much a question of whether AI agents will be incorporated into DevSecOps workflows so much as it is to what degree. Many of the code review tasks that could be assigned to AI agents are not elements of the software development cycle that most humans, especially, enjoy performing. Just as importantly, every vulnerability remediated before an application is deployed is one less fix an application developer is going to be asked to make weeks, sometimes, even months, after they have moved on to another project.

Eventually, there will, thanks to the rise of AI, come a day when shipping code with known vulnerabilities will be widely considered unacceptable. The sooner DevSecOps teams start working toward achieving that goal, the better off everyone affected by the current state of application security will become.

April 29, 2025
Lineaje Leverages AI Agents to Secure Open Source Packages and Images

Lineaje has added artificial intelligence (AI) agents that leverage multiple types of code scanners to ensure the open-source software packages and artifacts being used by application developers are truly secure.

Company CEO Javed Hasan said the Gold Open Source Packages and Gold Open Source Images are curated by AI agents trained to automate tasks based on data collected by a software composition analysis (SCA) platform, dubbed SCA360.

SCA360 also provides access to a Deep Dependency and Reachability Scanner to identify mandatory and optional dependency chains and their inherent risks. That scanner is coupled with a static code analysis engine that detects reachable vulnerabilities and linked functions to surface insights into transitive dependencies. Finally, a malware Scanner detects embedded malicious and tampered packages, highlighting those of dubious origin.

Using those scanners, the Gold Open Source Images services provide software engineering teams with a catalog of over 2,000 vulnerability-free images. The Gold Open Source Packages similarly ensures that more than three million open source packages are free of known vulnerabilities by tracking more than 100 attributes for each package and its transitive dependencies. In total, Lineaje is now using AI to track more than 408 billion open-source security data points, including vulnerabilities, licenses, geo-provenance, maintainability, code quality and contributors.

Lineaje AI agents can compare versions of packages and images to generate compatibility analysis, which the AI agents then use to continuously scan source code repositories, detect security issues, find updates for direct dependencies in the source code and remediate them, said Hasan. In effect, open source software can now become self-healing, he added.

Additionally, those AI agents will highlight any known issues with existing application environments, said Hasan.

Finally, application developers can also generate custom Gold Images on demand by specifying an existing public container image. Lineaje AI will then automatically create a compatible, hardened Gold Image that is added to all Gold Open Source Image subscriptions.

Lineaje will also continue to provide existing manual services for application development teams, including providing security updates to older generations of open source packages and images that DevOps teams, for one reason or another, can’t update without breaking an application.

While a lot of progress has been made in terms of adoption of best DevSecOps practices, there is still plenty of room for improvement, given the number of vulnerabilities and other issues being discovered either in production environments or just before an application is supposed to be deployed. One way to achieve that goal is to, of course, ensure the software artifacts that developers rely on to build those applications are, from a cybersecurity perspective, as pristine as possible.

In the meantime, DevSecOps teams would be well advised to encourage developers to not, whenever possible, rely on images and packages that have not been somehow certified. It’s not that any developer starts out to build an insecure application, but rather for there to be a laissez-faire tendency to grab the first image or package at hand that looks like it might fit their purpose.

April 29, 2025
Minimus Unfurls Service for Accessing Secure Software Artifacts

Minimus today at the 2025 RSA Conference launched a managed service through which it ensures application development teams are provided access to a secure set of minimal container images and virtual machines.

Company CTO John Morello said the Minimus service eliminates the possibility that developers might inadvertently download software artifacts that might be infested with malware.

At the core of the Minimus service is an operating system the company specifically developed to make managing the orchestration of software artifacts simpler. That capability then enabled Minimus to ensure that hardened software artifacts that have been configured to minimize the overall size of the attack surface that might be presented can be integrated into DevSecOps workflows, said Morello.

Minimus also constantly monitors threat intelligence to ensure the security of those artifacts while also providing developers with real-time insights into potential threats to reduce overall risk, he added.

While a lot of progress has been made in securing software supply chains, too many developers are still downloading software artifacts from insecure repositories. The Minimus service provides an alternative approach to accessing software artifacts that have been vetted by application security experts for known vulnerabilities and security weaknesses, said Morello.

It’s not clear why more DevSecOps teams are not limiting the number of repositories that application developers can use to download software artifacts but cybercriminal syndicates have clearly become more adept at injecting malware into them as part of an effort to infect as many downstream applications as possible. Unfortunately, it might not be years before that malware is actually activated.

DevSecOps teams have been making a concerted effort to provide application developers with scanning tools that discover vulnerabilities and malware in software artifacts. However, the success of those efforts is often limited simply because the number of alerts being generated overwhelms the ability of application developers to recognize and remediate issues based on their actual severity. The Minimus service reduces the need to run those scans by ensuring the software artifacts being used are secure in the first place, said Morello.

It’s not clear how many application security incidents can be traced specifically back to vulnerabilities and malware in software artifacts, but most developers would prefer to not have to address an issue discovered months, sometimes even years, after an application has been deployed in a production environment. As always, an ounce of prevention is always going to be worth more than a pound of any proverbial cure.

The challenge at this point isn’t so much finding the technologies required to secure those artifacts as much as it might be changing the culture of application developers that have for decades now routinely downloaded artifacts from public repositories without considering the application security implications.

Hopefully, the overall state of application security will improve as more organizations move to lock down their software supply chains. In the meantime, however, DevSecOps teams rather than investing in more tooling may want to consider trying to solve the issue at the root source of the repository problem.

April 28, 2025
Five Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration.

Dice.com

Citi
Rutherford, NJ
Senior Vice President – Technology Infrastructure/DevOps Lead
$176,720 to $265,080

Indeed.com

NVIDIA
Holmdel, NJ
Senior DevOps Infrastructure Engineer
$168,000 to $333,500

SimplyHired.com

Toyota
Plano, TX
Senior DevOps Software Engineer
$121,000 to $179,000

The Job Network

InVita Healthcare Technologies
Baltimore, MD
DevOps Engineer
$115,000 to $125,000

LinkedIn

Madison Square Garden Entertainment Corp
New York City
Senior DevOps Engineer
$113,000 to $190,000

April 28, 2025
Cycode Adds AI Agent Teammates to Secure Software Supply Chains

Cycode, this week, added multiple artificial intelligence (AI) agents to its application security posture management (ASPM) capable of monitoring code and offering remediation suggestions.

In addition, the company is adding an ability to, in real-time, monitor continuous integration processes running in memory. That capability makes it possible to thwart, for example, recent attacks that exploited tj-actions files to compromise continuous integration/continuous delivery (CI/CD) infrastructure and developer credentials.

Amir Kazemi, director of product marketing for Cycode, said collectively these capabilities will enable DevSecOps teams to streamline workflows in a way that reduces the friction and chaos many of these teams currently encounter.

The agents being added between now and June to the Cycode platform, dubbed AI Agents, tap directly into a Risk Intelligence Graph (RIG) developed by Cycode to surface, for example, issues involving code repositories, workflows, secrets, dependencies and cloud infrastructure assets.

There is also a Change Impact Analysis Agent that monitors code changes across pull requests to identify material changes that significantly alter risk posture.

Finally, there is an Exploitability Agent that invokes the static application security testing (SAST) and source code analysis (SCA) scanning tools embedded in the Cycode platform, the results of which can be passed on to a Fix & Remediation Agent that analyzes the root cause of an issue to suggest code fixes that align with frameworks and the coding patterns variable naming patterns being used by application development teams.

That ability to share data and context between agents is enabled by the Model Context Protocol (MCP), an emerging de facto standard integration framework for AI agents that was originally developed by Anthropic. MCP essentially functions as an operating system for AI agents, said Kazemi.

Longer term, Cycode also plans to leverage the agentic AI framework it has developed to build additional agents that can be assigned additional tasks, he added.

It’s not clear how rapidly DevSecOps teams are taking advantage of AI tools to improve application security, but as these technologies mature, there is a clear opportunity to improve application security without having to rely as much on cybersecurity teams to discover vulnerabilities in production environments that they hope application developers will have the time and expertise needed to fix. Instead, most issues will, hopefully, be surfaced and addressed long before that code is deployed.

The challenge, of course, will be not only finding the funding needed to acquire these AI tools, but also adjusting workflows to incorporate them. Many application development teams are relying on DevOps pipelines to build notoriously fragile applications. Improving the security of the software supply chain, however, may present an opportunity to address those issues and more as organizations look to securely deploy more applications at scale.

Regardless of motivation, there might soon come a day when deploying software that has known vulnerabilities becomes truly inexcusable when there is a cadre of AI agents standing at the ready to ensure only the code of the highest quality ever makes it into a production environment.

April 24, 2025
Endor Labs Adds AI Agents to Automate Application Security Reviews

Endor Labs today added a set of artificial intelligence (AI) agents to its platform, specifically trained to identify security defects in applications and suggest remediations.

Fresh off raising an additional $93 million in funding, Endor Labs founder and CEO Varun Badhwar said going beyond simply identifying vulnerabilities in code, these AI agents are trained to assess the architecture of an application for security flaws, along with suggestions for improving security.

Those AI agents have been trained using both the data that Endor Labs collects from its code scanning tools and the software engineering expertise provided by its internal research and development teams, he added.

Specifically, Endor Labs has spent more than three years analyzing 4.5 million open source projects and AI models, mapping more than 150 risk factors, building call graphs to index billions of functions and libraries and annotating exact lines of code where known vulnerabilities exist.

That level of context enabled Endor Labs to build multiple agents to function as application developers, architects and security engineers that work in concert with one another to analyze applications at their most fundamental architectural level, said Badhwar. Those agents are, for example, able to review every pull request (PR) for architectural changes that might impact application security, he added.

That approach also enables Endor Labs to set up guardrails that ensure the AI agents it has developed generate accurate outputs that application developers can trust, noted Badhwar. Additionally, Endor Labs is also adding support for a Model Context Protocol (MCP) plugin for the AI coding tools developed by Cursor, along with existing support for GitHub Copilot coding tools

That level of integration is critical because, as application developers increasingly embrace AI tools to write code, the number of applications that DevSecOps teams will need to review before they are deployed is about to exponentially increase, said Badhwar. Much of that code, however, contains vulnerabilities simply because the AI tools creating it were trained using samples of code randomly collected from across the Internet, much of which is inherently flawed, he added.

The only way DevSecOps teams will be able to keep pace with the rate of application development and deployment is to employ AI agents capable of identifying issues as code is being created, said Badhwar.

It’s not clear at what pace DevOps teams are embracing AI tools to write code that actually finds its way into a production environment, but a Futurum Research survey finds 41% of respondents expect generative AI tools and platforms will be used to generate, review and test code. The challenge, of course, is that the more code generated using those tools, the more likely it becomes that application security issues will arise.

Hopefully, AI will, in effect, be relied on more to secure the code being created by both machines and humans, both before and, when needed, after it is deployed. There is a clear opportunity to apply AI to reduce the massive amount of security debt that exists in legacy applications, noted Badhwar. In the meantime, however, DevSecOps teams would be well advised to review the quality of the code being generated by these tools before any security incident inevitably occurs.

April 23, 2025
Veracode Extends Scope and Reach of DevSecOps Portfolio

Veracode today updated its risk management tool to provide integration with Kubernetes runtime environments, increased integration with code repositories to make it simpler to identify the origin of vulnerabilities and, available shortly, an ability to add tags and classifications to help streamline remediation efforts.

In addition, Veracode is now providing early access to Veracode Package Firewall, which makes use of Open Policy Agents (OPA) to enforce policies that prevent the usage of open source software dependencies that have known vulnerabilities using technology the company gained with the acquisition of Phylum earlier this year. It is scheduled to become generally available in June.

Derek Maki, VP product and GM at Veracode, said both additions to the company’s portfolio will enable DevSecOps teams to better secure software supply chains at a time when they are increasingly being targeted by cybercriminals who have developed coding expertise.

The latest extensions to Veracode Risk Manager (VRM), for example, now makes it possible to provide more real time context about threats in container applications both before and after they have been deployed in a runtime environment as part of a larger effort to improve application security posture management (ASPM), he noted.

While a lot of progress has been made in terms of adopting best DevSecOps practices, there remains much work to be done, noted Maki. There has been too much emphasis on shifting responsibility for application security solely onto the shoulders of application developers, he added. Instead of shifting that responsibility as far left as possible to application developers, organizations need a more balanced approach that makes it easier to, for example, identify vulnerabilities in production environments that are actually exploitable, Maki said.

Otherwise, cybersecurity teams wind up creating long lists of vulnerabilities for application developers to investigate that, in the final analysis, reduce the amount of time they have available to write additional code, he added.

Unfortunately, many DevSecOps teams are now trying to analyze data being generated by, on average, 45 different tools that are being employed across multiple silos within their organization, said Maki. The end result is an overwhelming amount of telemetry data that is too difficult for DevSecOps teams to analyze in any meaningful way with a tool such as VRM, he added.

Each organization will need to determine how best to apply limited DevSecOps resources as they best see fit, but the one certain thing is the amount of code moving through their pipelines is only going to exponentially increase in the age of generative artificial intelligence (AI). Not all that code will make it into a production environment, but it will need to be tested for vulnerabilities that could be introduced at multiple points of the software development lifecycle (SDLC).

The challenge, as always, is finding a way to eliminate as many issues as early as possible without inundating application developers who are not cybersecurity experts with a stream of alerts that, because they are not likely to comprehend, will simply be ignored.

April 22, 2025