November 2026 Summaries

Snyk’s Evo Agentic Development Security introduces MCP Governance to help organizations manage the growing use of Model Context Protocol servers, which its research found were widely deployed across nearly 10,000 developer environments and sometimes carried high or critical risks. The approach begins with discovering MCP servers both on developer endpoints and in source repositories, then centralizing inventory details such as origin, usage, approval status, authentication, and risk findings. Evo ADS assigns risk scores based on server behavior, trust indicators, and, when available, implementation and dependency analysis, while noting that some unsigned servers cannot be confidently scored. Organizations can create an allowlist, monitor policies before enforcement to understand potential workflow effects, and ultimately block unapproved high- or critical-risk servers locally at runtime while allowing lower-risk unapproved servers to continue operating in log mode. Snyk presents the process as a phased way to balance developer access to MCP capabilities with centralized security oversight, with plans to extend similar controls to agent skills, sensitive-data access, prompt injection, and secret exposure.

Snyk announced that it was named a Leader in Forrester’s 2026 evaluation of agentic development security tools, receiving the highest strategy score and top marks for capabilities including AI dynamic testing, coding guardrails, autonomous remediation, and developer experience. The company argues that AI coding agents have accelerated development and expanded security risks by independently using packages, MCP servers, skills, tools, and sensitive data, while attackers increasingly operate at automated speed and can combine lower-severity vulnerabilities into serious exploit paths. Snyk contends that conventional post-development scanning and backlog-based remediation are insufficient, particularly as organizations deploy AI applications faster than they can inventory and govern their models, agents, and related components. Its Evo by Snyk platform is presented as a suite addressing code security, governance of AI coding agents, AI application risk management, and continuous offensive testing, with independent validation intended to confirm exploitable risks. The company says its approach combines AI reasoning with deterministic security engines to help enterprises embed security controls into agent workflows while maintaining oversight of AI-generated software.