Turn Your Vulnerability Backlog Into Pull Requests With Agentic Remediation

The Evo Remediation Agent is now in Open Preview, bringing automated dependency resolution to Evo Agentic AppSec. AppSec teams can now run ongoing remediation campaigns across repositories and deliver proposed fixes to developers through validated pull requests.

Fixing a dependency vulnerability can mean choosing an upgrade, resolving dependency conflicts, adapting the application, and/or checking the result. That work competes with everything developers are already building. As teams introduce code and new vulnerabilities at increasingly exponential rates, AppSec needs a way to accelerate remediation across the applications they protect.

With the help of agentic remediation, AppSec teams can start by leveraging campaigns targeting a defined set of repositories and vulnerabilities. Snyk supplies the model and hosted sandbox environment, and developers receive proposed changes through their existing source code management (SCM) workflow. The developers continue to retain control over final review and merging.

Give AppSec a way to drive fixes

A remediation campaign defines which vulnerabilities the agent works on, in which repositories, and on what schedule. AppSec teams set the scope, and Evo Remediation Agent works through eligible vulnerabilities and opens pull requests for developers to review.

For example, an AppSec team can launch a campaign targeting high- and critical-severity dependency vulnerabilities across repositories in a Snyk Organization. Recurring campaigns repeat that work on a schedule as repositories and vulnerability findings change.

That gives AppSec teams a way to initiate remediation without asking each developer to install and run an agent. Teams can follow repository outcomes across a campaign, review where the agent produced fixes, and investigate where remediation efforts still need attention.

Snyk first brought automated dependency updates into developer workflows with automatic Fix PRs across SCA and Container. Agent Fix extended remediation to source-code vulnerabilities detected by Snyk Code, our first AI-native solution generating and checking proposed fixes. The initial Evo Remediation Agent then brought a broader workflow into the CLI and ADE: plan the fix, apply changes, and validate the result in the developer’s environment. Now, fully validated, the next iteration of the Evo Remediation Agent brings campaigns that automate agentic remediation to AppSec teams.

Starting once again with Open Source vulnerabilities, teams can put the agent to work across repositories and make remediation an ongoing part of their security program.

Security context guides the work

A dependency update can require changes throughout an application. The agent uses Snyk findings to plan updates, applies changes in a hosted sandbox, and checks its work with builds, available tests, and rescans. This feedback helps the agent work through the changes an upgrade requires.

When the agent produces a fix, it opens a pull request and records each action attached to the change. Teams can restrict campaigns to fixes assessed as non-breaking, and the agent does not merge changes. Developers review the proposed changes and decide whether to merge them.

Evidence behind the remediation engine

Generating a fix only helps reduce risk if a developer can merge it. A pull request that breaks the build, fails existing tests, or leaves the vulnerability in place adds review work and doesn’t shrink the backlog. A high mergeable fix rate is what turns agent fix suggestions into backlog reduction because more of the fix pull requests actually get merged with less developer rework.

The VulnBump benchmark tests the mergeable fix rate of the engine that powers Evo Remediation Agent. Across 307 dependency-upgrade tasks, the CLI-based Remediation Agent passed all four verification checks on 90.2% of tasks. Claude Code with Snyk findings passed 77.5%, and Claude Code alone passed 59.6%. All three used the same model.

Those checks cover the outcomes that matter to a dependency fix: dependencies resolve, the targeted vulnerabilities disappear on rescan, the application builds, and previously passing tests still pass. The results show the value of combining security context with a purpose-built remediation workflow.

Fix first. Prioritize the rest.

Remediation programs usually start by deciding what to fix. Evo Remediation Agent reverses that order, giving AppSec teams another way to act on the backlog. Recurring campaigns work through eligible vulnerabilities in scope, so what reaches your team is then the work that needs human judgment.

Repository outcomes and journals help teams understand where the agent made progress and where further work remains. AppSec teams get a running view not only of the backlog, but also the pull requests opened, while developers get a record of why each change was made. Remediation consequently becomes an ongoing part of the security program, with your team setting the standard for what ships.

Bring remediation to your team

The Evo Remediation Agent is in Open Preview for Snyk Open Source vulnerabilities in Evo Agentic AppSec. To run campaigns, you need:

• Workspaces

• SCM integration

• Preview access for your Tenant.

During Open Preview, a daily fix allowance applies, and hosted sandboxes use public package registries. Ready to put Evo Remediation Agent to work on your backlog? Talk to your Snyk account team about Open Preview access.