Snyk, the AI security company, today announced Evo Agentic AppSec, a team of AI security agents that finds, fixes and blocks vulnerabilities at the speed agents write code, with every result verified independently of the agent that produced it. Agentic development has outpaced the AppSec model built for human-written code.
This puts backlog zero within reach for enterprises for the first time ever.
"Snyk started with a simple thesis. Every defect is cheaper to fix the closer it sits to the moment of creation. Agents write the code now, so security has to shift in, inside the loop where code is created. And the test is not whether a fix was generated. The test is whether it ships. A model grading its own homework is not a security program. It is a conflict of interest with a dashboard," said Manoj Nair, Snyk CTO and chief innovation officer.
Pointing general-purpose LLMs at the problem won't close the gap. Snyk's latest VulnBench report shows that 49.7% of the time, LLM security reviews report a finding that disappears on the next run. Today, with AI-driven attacks, fixing issues is the bottleneck. In separate research, VulnBump, Snyk demonstrates that LLMs alone produce a mergeable fix only 59.6% of the time. In the same benchmark, held to the same mergeable fix standard, Evo Remediation Agent raised that rate to 90%.
New critical and high-severity security issues detected across Snyk customers grew 10x in the past year, and analysis of Snyk's product data showed roughly 8 new vulnerabilities introduced for every one remediated.
"A pull request scan was built for human speed and human volume," Nair said. "It still matters. It was never going to be enough on its own once code was generated continuously and attacks were automated against it."
"The backlog you have been managing for years is not a cleanup project anymore. It is an attack surface," Snyk CEO Ken MacAskill said. "Backlog zero used to be a fantasy, but in the era of agentic development and attacks it must be the standard."
Evo Agentic AppSec works the application security loop at machine speed, with humans on the loop: understand application, model threats, find vulnerabilities, decide what is worth fixing, and ship validated mergeable fixes. The agents do not replace Snyk's deterministic engines. They operate them, calling Snyk Code, Snyk Open Source and other engines as tools. Agents include Evo Code Scanning Agent pairing frontier AI reasoning with static analysis, Evo Dependency Firewall blocking malicious packages at install time including slopsquatting, Evo Agentic Security Review delegating full security review building application and threat model, Evo Remediation Agent running full fix loop autonomously at scale, and Evo Secrets Detection catching leaked credentials.
"Agents do the work. Something independent proves it holds. Humans own the bar," Nair said. "The generator cannot be the validator."
About Snyk
Snyk, the AI security company, empowers the AI-driven enterprise to develop and secure its future, ensuring organizations can trust AI to innovate without limits. The Snyk AI Security Platform secures software at build speed, weaving protection directly into the creation flow to secure GenAI code, AI-native applications, and agentic systems. By delivering visibility, control, remediation and autonomous defense securely at inception, Snyk enables more than 4,800 global customers to build fearlessly in the AI era.
