August 4, 2026
0 mins readAt Black Hat USA 2026, Snyk brings Evo Continuous Offensive Security to general availability: autonomous, AI-powered pentesting that closes the gap between your once-or-twice-a-year pentest and the 350 days a year attackers never stop. COS is the new hero of one connected defense, built to answer the question every board is now asking: how do we prepare for autonomous AI attacks?
It’s no longer news that AI has thoroughly rewritten the way software is built. The code that used to take days to ship now takes minutes, and we're all benefiting from AI coding assistants and, increasingly, from autonomous agents working side by side. But with that great power comes the great responsibility of coping with that level of acceleration, which is doing something to security teams that they're only beginning to reckon with now: the greatly expanded surface attackers can now target, while being given the same reasoning-capable AI that developers are using to build that fast.
The reckoning is also in the fact that the surface now spans three fronts at once: architectural flaws that only reasoning-capable systems can find, credentials leaking from AI-generated code, and models and agents now embedded directly in the development lifecycle. And adversaries are now probing all three simultaneously at machine speed.
In June, the Five Eyes Alliance warned that AI is on track to bypass current cybersecurity capabilities in months, not years, with adversary breakout time now measured in seconds. Gartner forecasts the window to exploitation will be cut in half by 2027, while Snyk's own latest research into enterprise AI adoption tells the same story, but from the inside: agentic development is accelerating faster than security programs can track it. Defending against all that takes four things, not one.
Today, at Black Hat USA 2026, Snyk is responding to that shift with its broadest expansion of the Snyk AI Security Platform to date. Not with a bundle of products, but with a connected defense organized around the four steps organizations need to innovate securely: discover the full attack surface, remediate the inherited backlog, validate what an attacker can truly exploit, and prevent new risk from rebuilding it.
Leading it is the general availability of Evo Continuous Offensive Security (COS): autonomous, AI-powered pentesting that keeps pace with AI-accelerated development. Alongside it, Snyk is announcing enhanced AI Security Posture Management, a first look at Evo Agentic Application Security, and the general availability of Snyk Secrets. Together, these secure the full lifecycle of AI-accelerated software: how it's built, what it's built from, and how it's attacked.
One connected defense: Discover, Remediate, Validate, Prevent
One connected defense is table stakes against an attacker who now reasons about your application at machine speed, for the price of tokens:
Discover: see the full software and AI attack surface: models, agents, MCP servers, skills, tools, and what each can reach. The first step is delivered by AI-SPM, the AI-BOM, and the Snyk AI Security platform.
Remediate: clear the inherited backlog before autonomous attackers work through it faster than people can respond. This step is delivered by Snyk’s application intelligence and autonomous remediation.
Validate: continuously attack applications to prove fixes held, show what’s still exploitable, and surface the architectural and business-logic flaws no scanner reaches. This step is delivered by Evo COS.
Prevent: stop secrets, malicious packages, and new vulnerabilities from rebuilding the backlog as humans and agents write software. Finally, this is delivered by Snyk Secrets, prevention gates, and malicious code defense.
Because Snyk already understands the code, the dependencies, the APIs, the AI components, and the development context, each capability makes the others sharper instead of adding one more disconnected tool. That’s the difference between a platform and a bundle.
The problem: attackers moved up the stack, and testing didn't follow
For over two decades now, one distinction has held true in application security: scanners find the implementation-level bugs, and human pentesters find the architectural flaws. Automated scanners became genuinely excellent at the first category, finding SQL injection, cross-site scripting, misconfigurations, and the injection and pattern classes visible in code. Hundreds of vulnerability classes are now caught reliably across the software lifecycle. That's a real and durable win, and it isn't going anywhere.
But attackers have moved up the stack, toward the design-level flaws that require understanding what an application is designed to do before you can exploit it. These live in a system's trust relationships, not in its code, so they don't have a signature you can scan for. Consider the shape of them:
In 2019, First American exposed roughly 885 million financial documents. It didn’t happen through malware or a zero-day, but by changing a single number in a URL. Every scanner ran clean, and the application did exactly what its code said. It just wasn't supposed to let one customer read another's documents.
In January 2026, researchers disclosed BodySnatcher (CVE-2025-12420, CVSS 9.3): a single email address was enough to impersonate any ServiceNow administrator and take over the platform's AI agents. No passwords were hacked, there was no exploit code, but what was there, in fact, was just a design that trusted the wrong thing.
This is the class attackers are exploiting now: Broken Object-Level Authorization (BOLA) and privilege escalation by manipulating identifiers, cross-tenant leakage that exfiltrates customer data, and chained business-logic attacks where a few low-severity issues combine into account takeover. A decade of dormant lows and mediums, plus every new finding, is now reachable and chainable at machine speed. And you cannot write a scanner rule for "user A should not be able to read user B's invoice," because that rule depends entirely on what the application is supposed to do.
Finding these flaws has always required human reasoning, which is why it has always meant having a manual penetration test. And manual pentesting is irreplaceable, but it is bound by human time. A typical engagement runs 15 days and costs anything from $20,000 to $100,000, while it captures a single point in time. The coverage window closes the moment the report ships, by which point the application has already shipped several more releases. Your pentest covers roughly 15 days a year. What's happening the other 350? Development doesn't stop, and neither do attackers. Every release that ships in that window goes untested at exactly the layer where the highest-impact risk lives.
AI changes the math, not the discipline
Here's what actually changed. The reasoning step that only a human pentester could perform, modeling an application's intent, then figuring out how to subvert it, is now something a sufficiently capable model can perform too, repeatably, at a fraction of the cost. The discipline is the same, but the economics are definitely not.
The proof is already public and at scale. In the year to mid-2026, valid AI-generated vulnerability reports to HackerOne rose 210%, with prompt-injection reports up 540%, a surge concentrated in exactly the reasoning-dependent flaws scanners can't see. The reasoning line that held for twenty years didn't erode gradually; it fell in the space of a model generation.
The truly uncomfortable corollary is that attackers crossed the same line at the same moment, and they're already operating end to end. In one state-sponsored cyber-espionage campaign disclosed in late 2025, as much as 90% of the operation was executed by AI rather than human hackers (Anthropic Threat Intelligence, November 2025).
The question stopped being whether AI can find and exploit the flaws that scanners miss, rather whether your offensive security testing finds them before an attacker does.
Evo Continuous Offensive Security, generally available
We developed Evo Continuous Offensive Security to close that very gap. It's an AI-powered pentesting capability built on an enterprise-grade AI harness that reasons about application intent to uncover the architectural flaws and business-logic vulnerabilities traditional scanners miss. And it runs continuously, not once a year.
Crucially, COS does not test blind. Because it's part of the Snyk AI Security Platform, it receives context from existing Snyk Code, Snyk Open Source, and Snyk API & Web findings – as well as Evo AI-SPM, with additional insights for testing AI-native apps.. That means it directs its reasoning toward flaws those tools can't catch, rather than spending expensive model cycles rediscovering the vulnerabilities they already found. As our team puts it: if a bug is worth $1 and a flaw is worth $100, why spend pentest cycles rediscovering $1 bugs?
The capability is delivered through three integrated pieces that work as one continuous offensive program, with reasoning where it counts, exhaustive where it pays, and purpose-built for the new AI attack surface:
Reason like an attacker - AI Pentesting is the brain of COS. It self-scopes, plans a multi-stage attack, and validates exploitability, orchestrating the specialized agents and every tool in the harness to find the architectural flaws and business-logic abuses scanners and manual testers miss. Every confirmed vulnerability ships with a runnable proof of concept: proof, not a description.
Red-team the AI layer - Agent Red Teaming is purpose-built for the agentic layer of AI applications, engaging the moment reconnaissance detects an LLM in the stack. It simulates the real attack chain, with user prompt --> prompt injection --> tool and agent abuse --> data exfiltration, targeting prompt injection, exfiltration, and goal hijacking that no signature can catch.
Cover the commodity classes - Dynamic Testing (DAST) provides exhaustive, highly deterministic coverage of every endpoint and injection point for the commodity classes, such as XSS, SQL injection, and misconfigurations, with a 0.08% false-positive rate. The reasoning layer invokes it as a tool rather than burning cycles validating commodity bugs, so the AI spends its time on flaws, not on triage.
Findings don't arrive as a flat list of disconnected alerts; they arrive as connected exploit chains, showing how an authorization gap and a logic flaw combine into a high-impact attack path, the way an attacker would actually think about your system.
And COS directly addresses the trust problem that undermines naïve approaches: the same AI can't be trusted to both find and confirm a flaw. The generator can't be the validator. A model asked to certify its own findings has a structural conflict of interest, and it behaves inconsistently when it tries. So every COS finding is cleared by an independent validation judge before it surfaces, with an extremely low false-positive rate, compared with roughly 30% for raw AI tools. It then ships with the runnable proof-of-concept and the full reasoning trace behind it, so your team doesn't get an alert to take on faith; it gets an exploit it can actually run.
That's the real point of difference, and it's worth being precise about: a capable model is not a pen test. It's the system, not the model, the enterprise AI harness around the reasoning that makes autonomous offensive testing trustworthy. Persistent context and memory across runs, controlled execution and governance that keep it safe against production-adjacent environments, reproducibility, and the platform intelligence that feeds every assessment. Point solutions start from scratch on every run, with no memory, no platform context, and no governance. That's the gap the harness closes.
Just as importantly, COS doesn't replace the security engines you run; it's complementary: the scanners keep owning the implementation-level classes they're excellent at, human testers keep owning the highest-judgment work, and COS fills the continuous, reasoning-dependent layer between them, re-validating every time your application changes.
Completing the defense: Discover, Remediate, Prevent
Validation is the sharp end, but it's one move in a loop, and a loop is only as strong as the parts around it. COS can only prove what an attacker could exploit because the platform around it discovers the full attack surface it tests, clears the backlog an attacker would otherwise walk through, and stops new risks from rebuilding faster than you can test. Three announcements close that loop, and each one makes COS sharper.
Discover - Enhanced AI Security Posture Management
Discover (AI-SPM): Discovery is what points COS at the right targets, and, increasingly, what feeds it: the AI-BOM and AI-SPM signals COS uses to test AI-native apps.
You can't govern what you can't see, and most organizations still can't see the layer where AI risk now lives. Snyk is shipping a major upgrade to its AI Security Posture Management (AI-SPM) risk intelligence: an overhauled model risk taxonomy and scoring engine, plus new skills and MCP server risk analysis surfaced directly inside the AI-BOM. The result is visibility into what your agents are actually touching: every model, skill, and MCP server in play. And a sharper, more defensible way to score the risk each one carries. As Snyk's newly released research makes clear, an organization's real AI footprint is far larger than its model inventory suggests, and the majority of governance programs still have no view into it. This closes that gap.
Remediate - Evo Agentic AppSec: a first look at what's next
Remediate (Agentic AppSec): Remediation is what turns a COS finding into a closed risk instead of another ticket.
Snyk is also offering a first preview of Evo Agentic Application Security, its vision for autonomous application security, where AppSec shifts from finding issues to autonomously fixing and defending against them. It's anchored by the public preview of Snyk's remediation agent via CLI and ADE, which fixes vulnerabilities automatically rather than handing developers a backlog to triage, and a first look at a new malware detection agent built to catch malicious code before it ships. This is the direction the discipline is heading, and it's where the next chapter of the platform begins.
Prevent - Snyk Secrets, now generally available
Prevent (Snyk Secrets): Prevention is what keeps COS from re-finding the same problems next quarter.
Finally, Snyk Secrets: a secrets detection and prevention product built for the agentic development lifecycle (ADLC), is now generally available. AI-generated code has made leaked credentials a first-order problem, and Snyk Secrets uses a proprietary machine learning detection engine that reads the context around a candidate secret to cut false positives, with prevention gates across AI coding agents, IDEs, pull requests, and CI/CD. It's a natural part of securing how agentic software is built, by stopping credentials from ever reaching production while developers keep moving.
"The volume and pace of AI-generated code has fundamentally outpaced the pentesting model most of us have been running for years. We can't schedule our way out of a continuous risk surface. What we need is offensive testing that keeps up with how we actually build software today — with enough context to focus on what's genuinely exploitable, not just what's theoretically possible.", Gabriel Brolo, Staff Security Engineer, Yalo
Why it matters
Take a quick step back, and the four announcements make a single case. AI accelerated every part of how software is created, and in doing so, it expanded the attack surface across the whole lifecycle: the code AI writes, the credentials and components it's built from, the models and agents embedded within it, and the running application an adversary probes. Point tools and point-in-time testing were built for a slower, more linear world. Securing AI-accelerated software means testing it the way it's built and attacked now: continuously, with the whole platform's context, and with results you can trust because the model that found the flaw isn't the one that graded it.
That's what it means to secure the full lifecycle of AI-accelerated software: how it's built, what it's built from, and how it's attacked.
Availability
Evo Continuous Offensive Security and Snyk Secrets are now generally available. The enhanced AI-SPM capabilities are available now to existing customers. Evo Agentic AppSec's remediation agent is in public preview via the Snyk CLI, with the malicious code detection agent in private preview. Book a demo to learn more about Evo today.
Live Webinar
OpenAI Graded Its Own Homework, Then Broke Into Production
Join Snyk for a direct conversation on why self-validation fails by structure, why a multi-model stack makes it worse, and what independent validation looks like in practice.