June 2025 Summaries

AI coding assistants are revolutionizing developer workflows by significantly increasing productivity and reducing time spent on repetitive tasks, but they introduce risks by potentially incorporating security vulnerabilities into code. This issue arises because AI tools operate faster than traditional human review processes, leading to a situation where developers may overlook security alerts or fail to address vulnerabilities due to "fix fatigue." To address these challenges, security tools must not only identify vulnerabilities early but also provide clear, verified fixes that developers can trust and integrate seamlessly into their workflows. Snyk's approach exemplifies this by offering real-time, context-aware scanning and validated fixes within the Integrated Development Environment (IDE), which helps maintain the momentum of development while ensuring security. This proactive integration of security measures aims to build trust among developers, enabling them to rely on these tools without fear of disrupting their flow or introducing new issues. By embedding security into the development process, tools like Snyk help prevent the disengagement that can occur when developers perceive security measures as obstacles rather than supports.

The Cyber Resilience Act (CRA), effective since December 2024, imposes stringent cybersecurity requirements on companies offering digital products or services in the EU, aiming to enhance security across connected devices and cloud-based software. Non-compliance can result in severe penalties, including fines up to €15 million or exclusion from the EU market. The CRA demands comprehensive security validation throughout the software supply chain, complicating compliance efforts due to the vast surface area of open-source libraries, third-party dependencies, and proprietary code. Balancing speed and security is challenging as DevOps environments often prioritize quick delivery over rigorous quality controls, which the CRA seeks to address. Legacy tools and fragmented visibility further hinder compliance efforts, but organizations can manage these challenges by adopting a security-first culture, implementing robust vulnerability management programs, and automating security testing throughout the software development lifecycle (SDLC). Security testing is crucial for CRA compliance, with tools like Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and Infrastructure-as-Code (IaC) playing distinct roles in identifying and mitigating vulnerabilities. Snyk offers solutions that integrate security testing directly into existing developer workflows, facilitating compliance by incorporating secure-by-design principles, managing open-source risks, enforcing secure cloud infrastructure, and validating runtime security, thereby helping teams remain audit-ready and simplify CRA compliance.

AI Trust is becoming essential for organizations that are rapidly adopting AI technologies to enhance productivity and innovation, as it ensures secure and controlled software development. This concept emphasizes the need for robust governance, risk management, and security policies to operate confidently in environments where AI-generated code is prevalent, with predictions that up to 90% of code could be AI-generated by 2025. The Snyk AI Security Platform exemplifies the implementation of AI Trust by providing AI-enabled risk management, dynamic policy enforcement, and continuous compliance, which collectively help organizations manage vulnerabilities and align security with development goals. As AI reshapes the developer experience, maintaining AI Trust offers a competitive advantage by mitigating risks associated with AI-driven threats and enabling teams to innovate safely and efficiently.

The Snyk AI Security Platform aims to enhance innovation, reduce business risk, and accelerate software delivery by providing robust governance and security features for AI-assisted development. Central to this platform is Snyk Code, which offers comprehensive security governance throughout the development process via static application security testing (SAST) and prioritization capabilities. A notable feature, Snyk Agent Fix, serves as an AI-powered code security assistant that autonomously generates and validates fixes with an industry-leading 80% accuracy, facilitating the secure and rapid remediation of code issues within IDEs and pull requests. The platform emphasizes visibility, prioritization, and policy enforcement, allowing security teams to set custom rules and manage risk effectively, while also maintaining data privacy through a custom, self-hosted language model. Overall, Snyk’s tools empower development and security teams to maintain strong AI governance, enabling faster and more secure innovation in software development.

Cursor has integrated Snyk's CLI MCP server into its curated set of MCP tools, enhancing security for its AI-driven development environment. This integration allows Cursor users to benefit from Snyk's robust security features, providing real-time vulnerability detection as code is generated. The Snyk CLI MCP server offers zero-setup interoperability, seamlessly integrating with Cursor to deliver in-agent security with minimal configuration. This ensures that developers can maintain agile iteration cycles while safeguarding against security flaws and outdated libraries. Users can easily activate Snyk's security capabilities within their Cursor workflows by visiting Cursor's MCP directory and ensuring their Snyk CLI is up-to-date, ultimately securing their code with advanced security intelligence.

As businesses transition from AI experiments to scalable implementations, they face new security challenges, particularly with AI agents that automate tasks. These agents expose vulnerabilities, such as data poisoning and prompt injection, which threaten AI model integrity and data security. The increasing complexity of AI systems, compounded by federated identity gaps and rapid developments in AI components, necessitates a new approach to risk management and governance. Despite the potential of AI to enhance problem-solving, its unpredictable nature complicates the detection of vulnerabilities and non-compliance with data privacy regulations. The importance of integrating security early in AI workflows is emphasized, with tools like Snyk’s AI Trust Platform offering solutions for secure and scalable AI-native applications. As AI becomes embedded in enterprise software, organizations are urged to adopt AI Trust, Risk, and Security Management (AI TRiSM) practices to maintain security and operational integrity.

Snyk has launched a dedicated API and web infrastructure instance in the Asia-Pacific (APAC) region to meet the local data residency and compliance needs of its growing customer base. This initiative not only ensures that scan data remains within the region, simplifying adherence to data privacy laws and corporate governance policies, but also enhances performance by reducing latency for APAC customers. The infrastructure supports Snyk's developer-first DAST capabilities, which are crucial for addressing the challenges introduced by AI-driven applications, especially regarding API security. Snyk's solution offers a "Shift Left" approach, allowing for the accurate and efficient identification and remediation of runtime vulnerabilities, while integrating seamlessly into every step of the software development lifecycle. The near-zero false positive rate of their DAST engine, combined with advanced detection for complex, API-rich applications, positions Snyk as a leader in modern application security. As the company continues to innovate, particularly in AI-driven security measures like BOLA detection and SAST and DAST correlation, the new APAC infrastructure further underscores Snyk's dedication to supporting secure, scalable software development in the region.

ANZ technology leaders are rethinking the intersection of AI, speed, and security due to the immense pressure from generative AI adoption. The region is moving ahead with both ambition and caution, wrestling with real-world dilemmas such as talent shortages, changing regulations, and managing cloud-native environments. To balance innovation and security, leaders must ensure secure AI adoption, eliminate speed without increased risk, provide visibility and risk prioritization, simplify security workflows, and consolidate tools. A dual approach is needed, using AI to boost security while securing AI systems themselves. ANZ leaders can build trust in the new AI world by fostering full visibility into risks, intelligent prioritization of real threats, and scalable policy enforcement.

Snyk Analytics has expanded its platform to address the need for a programmatic approach to security in an AI-enabled reality. The new features offer centralized access to reporting information, developer security insights, and customizable dashboards, empowering AppSec leaders to improve productivity, meet policy and compliance needs, and make faster, more informed decisions. Snyk Analytics provides reports on developer security practices, including visibility into CI/CD test usage, tracking of AI-powered remediation efforts, and measuring shift-left adoption. The platform also streamlines compliance with real-time reporting, offering a unified and user-friendly dashboard for security teams to oversee their organization's adherence to compliance standards. Custom dashboards can be created to tailor measures to correspond with distinct phases of the development process, while data extensibility enables users to prioritize resources, update policies, and implement new security measures. The Export API allows users to export Snyk reporting datasets programmatically, streamlining integration with other security tools and platforms.

AI coding assistants like GitHub Copilot and Google Gemini Code Assist are changing how developers work — accelerating delivery, removing repetition, and giving teams back time to build, but speed isn't free. Studies show that around 27% of AI-generated code contains vulnerabilities, not because the tools are broken, but because they generate code faster than most teams can review it. To unlock the benefits of AI without increasing risk, organizations should implement smart, developer-friendly checks known as guardrails, which are not rules or restrictions, but rather checks that let developers scale AI safely. One way to start is with pull request (PR) checks, which integrate directly into development workflows, scanning new code for vulnerabilities before it's merged into the main branch, and can be reinforced with Snyk CLI integration in the build pipeline. To truly support secure AI adoption, organizations must shift security left by catching vulnerabilities at the source, as code is being written, rather than just after it's committed. This can be done using local scanning capabilities and IDE plugins that deliver automatic fixes to developers. Incentivizing adoption rather than enforcing it is also crucial, with tactics such as making access to AI coding assistants contingent on local security setup or providing targeted training to raise awareness about AI-related risks. Centralized control and conditional access can also be used to embed security directly into access workflows using existing tooling. By pre-configuring environments with AI coding tools and security plugins side by side, security just happens, and teams that align productivity and security from the start will unlock the real promise of AI-assisted development.

The cost of poor software quality is estimated to be nearly 10% of the current GDP in the US, with a total cost of $2.41 trillion in 2022, and is forecasted to reach around $2.25 trillion by 2034. The worldwide software market is expected to triple in a decade, making it crucial for organizations to prioritize software quality and find security-related flaws early in the development process. This can lead to significant cost savings, efficiency gains, risk reduction, protection of business brand and reputation, lower insurance premiums, and improved developer productivity. Organizations that adopt a developer-first security approach can achieve a 72-day reduction in mean time to fix vulnerabilities, reducing costs and improving overall software quality.

Snyk, a company focused on software development and security, emphasizes the need for developers to adapt to an AI-powered future. To stay effective, developers must welcome AI as part of their everyday process, build new skills for the AI era, learn together with their teams, and secure AI workflows from the inside out. Snyk's AI Trust Platform is designed to provide developer-first application security that seamlessly embeds security into daily work environments, enabling developers to code confidently in AI workflows while staying aligned with security goals. By adopting these strategies, developers can empower themselves and their teams to build fast and innovate securely in an era dominated by AI.

Snyk has achieved FedRAMP Moderate authorization for its Snyk for Government platform, marking a significant milestone in providing secure development solutions for the US government. This certification underscores Snyk's commitment to building trust and ensuring the integrity of software that powers critical government functions. The platform empowers developers to find and fix vulnerabilities early and often, reducing risk and accelerating development cycles. Snyk for Government offers comprehensive vulnerability detection, actionable remediation advice, policy enforcement, integration with developer tools, and detailed reporting features, tailored to meet FedRAMP requirements. Leveraging AI-driven advancements, the platform will provide more accurate vulnerability detection, smarter remediation recommendations, and enhanced threat intelligence, enabling US government agencies to stay secure with modern development practices and cloud-native technologies.

The healthcare industry is rapidly growing, driven by software automation, but achieving HIPAA compliance is a daunting task due to the intricate regulations covering data transmission and access. Meeting HIPAA standards requires a strategic approach, including applying fixed rules such as encryption, access controls, audit controls, and vulnerability testing. Showing due diligence in vulnerability management is crucial, involving regular testing beyond surface-level checks to ensure all vulnerabilities are identified, tracked, and managed effectively. Snyk API & Web is a comprehensive tool for HIPAA-compliant application development, scanning for over 3000 vulnerabilities, including critical ones like SQL Injections and Cross-site Scripting (XSS), and offering automated, continuous security scanning capabilities to address potential vulnerabilities early.

The future of developer upskilling is human-led, AI-supported. Developers are no longer just code authors but reviewers, interpreters, and decision-makers who must learn to guide AI tools. This requires judgment, security awareness, and a new kind of fluency in human-computer collaboration. Snyk Assist offers real-time, contextual guidance available directly from workflows, reinforcing good security practices while enabling fast, AI-accelerated development. It surfaces learning opportunities based on actual vulnerabilities found in code, providing tailored lessons that help developers spot issues as they arise and understand why something is risky. By amplifying human judgment and empowering developers to stay in control, Snyk Assist creates more than just cleaner code; it creates smarter, more security-conscious developers who build security into their instincts.

Snyk Agent Fix is a tool that earns trust by combining hybrid AI with rigorous validation, providing vulnerability remediation that developers can apply confidently. It addresses the skepticism in security workflows by generating fixes fast and validating them before reaching developers, eliminating guesswork and fear of breaking production. Snyk Agent Fix uses a hybrid intelligence engine that combines machine learning with symbolic analysis to deliver over 80% fix accuracy, significantly reducing rework and risk. The tool is designed to be enterprise-ready, with guardrails that scale security for enterprises, ensuring safety, compliance, and alignment with organizational standards. It integrates directly into developers' existing environments, delivering fixes they can trust, validated, and explainable, ready to apply. With Snyk Agent Fix, trust becomes the currency determining which tools get adopted, as every fix reflects care, accuracy, and accountability required for real-world development.