Snyk, the AI security company, today announced that Evo by Snyk, the agent-native layer of the Snyk AI Security platform, now accounts for 60% of the company's new deal volume and is driving a 30% increase in average contract value. Evo has sustained an 81.5% month-over-month customer growth rate since the general availability of its first capability in March 2026, demonstrating how swiftly enterprises are moving AI security from experimentation to production.
Evo by Snyk reaches 60% of new deal volume
Drives 30% increase in average contract value
Sustained 81.5% month-over-month customer growth since March 2026
76% of customers who bought Evo in Q2 were in production before quarter closed
Processes 2.4 million agent supply-chain scans monthly
4.2 million agent behavior checks daily across 417,000+ onboarded machines
Enterprises already find more vulnerabilities than their developers can fix. Across Snyk's 4,800-plus customers, newly introduced issues rose 108% between Q4 2024 and Q1 2026 before agentic code generation reached full scale. AI is now widening that gap at both ends, generating more code and vulnerabilities than humans can review, while enabling attackers to discover and exploit weaknesses at machine speed.
Coding agents introduce a different layer of exposure. They pull in unvetted MCP servers and third-party skills and execute production actions that once required human approval. Traditional tooling scans artifacts, not the toolchain an agent assembles at runtime or the actions it takes with it.
"Vulnerabilities are compounding faster than teams can clear them, and on top of that, agents add a whole new layer of exposure," said Ken MacAskill, chief executive officer of Snyk. "We built Evo long before enterprises knew to ask for it, because the answer was never more AI grading its own homework — it has to be independent validation. Not only is Evo growing rapidly, but more than three-quarters of enterprises who bought Evo deployed it in production within the same quarter."
Snyk's architecture rests on a single tenet: the generator cannot be the validator. A model that writes code, or that grades its own agent's behavior, has an inherent conflict in certifying that the result is safe to ship. Open source issues remediated through Snyk's independent validation layer merge at a 94% higher rate than fixes produced by a frontier model working alone. Snyk's VulnBench research found that when the same code and the same prompt were run five identical times, nearly half of the issues flagged by an LLM alone appeared in only one of the five runs.
"The sequence is predictable," said Manoj Nair, Snyk's chief technology officer. "An enterprise introduces coding agents. Then it ships its own AI applications. Then it finds that attackers are probing both at machine speed. Evo covers the development loop, the production loop and the adversarial loop, because a loop with a missing segment is not a loop. It is a gap an autonomous attacker will occupy."
Evo applies shared context and deterministic validation across three connected security problems:
Evo Agentic AppSec puts security agents to work against the application security backlog. Secrets Detection is generally available, the Remediation Agent is in open preview, and the Agentic AppSec Agent is in private preview.
Evo Agentic Development Security governs the agentic development process itself, validating tools before they are trusted, governing agent behavior inside the execution loop and securing generated code. Generally available since June.
Evo AI-SPM gives security teams a live inventory of models, agents and AI applications, along with policies and auditability. Generally available since March.
Evo Continuous Offensive Security, generally available since August, tests that architecture continuously by attacking an enterprise's defenses to confirm that policies, controls and guardrails hold under real-world adversarial pressure.
"We're seeing supply-chain attacks, malicious skills and compromised MCP servers enter through the agent's own toolchain, alongside agents taking actions with no guardrails between intent and execution," said Brendan Putek, director of DevOps at Relay Network. "Working with Snyk, we landed on what I believe is the right architecture for agentic development security: controls embedded directly into the agent workflow that govern what an agent uses, executes and generates."
About Snyk
Snyk, the AI security company, empowers the AI-driven enterprise to develop and secure its future, ensuring organizations can trust AI to innovate without limits. The Snyk AI Security Platform secures software at build speed, weaving protection directly into the creation flow to secure GenAI code, AI-native applications, and agentic systems. By delivering visibility, control, and autonomous defense securely at inception, Snyk enables over 4,800 global customers to build fearlessly in the AI era.
