Snyk Launches Evo Agentic AppSec Agent Suite

Snyk announced on 15 October 2026 Evo Agentic AppSec, described as a team of AI security agents that find, fix and block vulnerabilities while calling Snyk’s existing deterministic engines. CTO Manoj Nair’s line in the release: “The generator cannot be the validator.”

Most of the newly named agents are in preview, not general availability. Growth and benchmark figures quoted below are Snyk’s claims.

What ships in the suite

Snyk says the agents operate engines such as Snyk Code and Snyk Open Source rather than replacing them. Named pieces include:

Evo Code Scanning Agent — pairs frontier model reasoning with Snyk static analysis for issues such as broken access control (company framing)
Evo Dependency Firewall — blocks malicious or out-of-policy packages at install time, including “slopsquatting” names hallucinated by coding agents
Evo Agentic Security Review — repository security review with application and threat modelling and evidence-backed findings
Evo Remediation Agent — autonomous fix loop for backlog and new code; Open Source issues at launch; fixes that might break the build are queued for approval
Evo Secrets Detection — credential leakage across traditional and agentic workflows

Snyk also ties the launch to earlier surface area: Snyk Studio, Evo Agentic Development Security (ADS) inside coding agents, and Evo Continuous Offensive Security as an independent attacker-style check that fixes hold.

Availability — preview vs GA

Per Snyk’s availability paragraph:

Experimental preview (select customers): Evo Code Scanning Agent, Evo Dependency Firewall, Evo Agentic Security Review
Open preview: Evo Remediation Agent
Generally available: Secrets Detection, Evo ADS, Evo Continuous Offensive Security

Do not write as if the whole agent team is GA.

Benchmarks and growth figures (company claims)

Snyk cites its VulnBench work: “49.7% of the time, LLM security reviews report a finding that disappears on the next run.” On VulnBump, it says LLMs alone produce a mergeable fix only 59.6% of the time, while Evo Remediation Agent “raised that rate to 90%” under the same mergeable-fix standard.

Separately, Snyk says critical/high issues detected across customers “grew 10x in the past year,” and that product data showed roughly 8 new vulnerabilities introduced for every one remediated. It also cites colour on malware and MCP/skill risk (18 high-profile malware-focused responses in 2026; projections on malicious packages; findings rates in MCP and agent-skill audits).

Treat VulnBench, VulnBump and the 10× / 8:1 figures as Snyk’s research claims, not independent audits.

Why Snyk says the model must change

Nair argues AppSec built for human PR volume cannot keep up once agents write code continuously and attackers automate too. CEO Ken MacAskill calls long-lived vulnerability backlog “an attack surface” and says “backlog zero” must become the standard. The product answer Snyk offers is agents on the loop for creation-time prevention, with humans still owning remediation trust for code that may already be running.

Context from earlier TSN coverage

Agent governance and exploit reality are both moving. TSN covered BeyondTrust’s critical Remote Support zero-day and ServiceNow’s AI Passport for runtime limits on agents and MCP servers. Snyk’s launch is the AppSec-vendor version of the same problem: secure agent-written code without letting the fixer mark its own homework.

What’s still unknown

Pricing and packaging for each Evo agent
When experimental-preview agents open more broadly
Third-party replication of the 90% mergeable-fix claim

What to watch

Watch Snyk’s preview expansion notes and whether Continuous Offensive Security results are surfaced beside Remediation Agent PRs by default.

What this means

Evo Agentic AppSec is announced as an agent team on top of Snyk’s engines.
Most new agents are preview; Secrets Detection, ADS and Continuous Offensive Security are GA.
VulnBench / VulnBump / 10× growth figures are Snyk’s claims.