Find, auto-fix, and prioritize intelligently, with Snyk's AI-powered code security tools

During the long-awaited Snyk Launch 2024, we announced the exciting general availability of Snyk Code's auto-fixing feature, DeepCode AI Fix, powered by our AI machine, DeepCode AI! To celebrate this milestone, let’s explore how Snyk’s AI-powered features differentiate our approach to application security.

AI is on everyone's minds, along with its countless applications that offer a wide variety of solutions (and issues). Application security is not immune to this AI revolution, and the issue of insecure code remains paramount. New and increased AI-related risks such as vulnerable AI-generated code being produced at scale, have made code security even more critical. 

Modern application security for AI-powered software development

In today’s AI world, accelerated development, rapid change, and unprecedented growth of security challenges demand a new approach to application security. To scale application security effectively and keep pace with AI, there is a pressing need to shift left and prioritize security issues more intelligently. This requires AI security tools that empower us to:

First: Remediate early in your IDE

Keeping up with AI-generated vulnerabilities means speed and early action. Shifting left by running security screens directly within the IDE, is the earliest point for intervention. This enhances development velocity by eliminating the need to build code before scanning, enabling immediate action on issues, and providing a seamless remediation environment without the need to context-shift. 

Snyk Code, a developer-first SAST tool powered by our proprietary AI, DeepCode AI, offers a fast and proactive solution. By running in your IDE, Snyk Code empowers developers to eliminate problems long before they proliferate in the pipeline, causing them to become costly and complex to solve. 

Second: Automate detection and remediation, to scan and auto-fix with speed, scale, and accuracy

Finding code security issues isn’t sufficient – the job isn't done until you’ve fixed those issues. To do this efficiently and correctly, you need reliable scan results. A good detection tool isn’t enough without a trustworthy auto-fix component that can keep up. Conversely, a good auto-fixing system is only as good as the detection tool it’s paired with. Both components must work seamlessly together.

AI-driven tools can significantly accelerate vulnerability detection and remediation for AI coding tools and LLM-sourced code. However, to fully benefit from the speed and scale of these tools, you also need accuracy. A tool that produces reliable results will help you avoid revisiting work you’ve already done, and eroding the value accumulated from fast scans. 

Snyk Code, the leading DevSecOps platform, offers DeepCode AI Fix, an LLM-powered, vulnerability auto-remediation feature. This tool empowers developers to safely utilize generative AI tools by detecting and auto-fixing unsafe code without disrupting their flow. A Fortune 100 company successfully employed Snyk Code to slash mean-time-to-remediate by 84% while using Snyk Code’s IDE plugin to rapidly and consistently scale code security across their team.

Find: AI-powered SAST-scanning 

Snyk Code’s specialist AI is created, trained, and fine-tuned for the sole purpose of security. The degree of accuracy in its results (thanks to laser-focused training data, as well as its speed of analysis) is evidence of this deep specialism. Snyk Code runs SAST scans that are 50x faster than legacy tools, and 2.4x faster than other modern SAST tools. Additionally, Snyk Code boasts an OWASP Benchmark accuracy nearly 20 percentage points higher than a well-known developer brand’s SAST solution for AI-generated code. This means that Snyk Code’s AI drives down noisy false positives and dangerous false negatives, producing more streamlined scan results, and ultimately delivering genuine time-savings for developers. 

Fix: AI-powered code-auto-fixing 

For developers to fully benefit from Snyk Code’s detection speed, remediation must keep up. Vulnerability detection is becoming more efficient, but remediation of such security risks is still tedious and time-consuming. And now, with AI-generated code introducing vulnerabilities at greater speed and volume than ever before, remediation takes even longer. Developers having to identify security issues and how to fix them efficiently, results in broken momentum, reduced fix rates leading to growing security debt, and unsafe, hasty workarounds.

To fix code vulnerabilities, clear security debt, and abstract away the increasingly time-consuming work of remediation, you need an AI-powered SAST tool that automates remediation simply and rapidly and integrates seamlessly into developer workflows. Snyk Code’s DeepCode AI Fix auto-remediation feature does just that. DeepCode AI Fix is currently available in early access, but will soon be generally available on October 29th, 2024.

How to switch on DeepCode AI Fix, from within your Snyk settings

Enable Snyk Code Fix in your Snyk settings as shown in the image above on October 29th, or if you haven’t got Snyk Code, register for a Snyk account, learn how to use Snyk in your IDE, and start auto-fixing reliably at the speed of AI.

Safer auto-fixing

DeepCode AI Fix presenting a couple of fix suggestions. The developer clicks “Apply Fix”, once a preferred suggestion is selected.

DeepCode AI Fix works by presenting up to 5 fix suggestions for a Snyk Code reported issue. The user selects the most suitable fix for his/her context and then applies it with a single click; they can be confident that the fix will not create additional security issues. And here’s where DeepCode AI Fix is unique – it doesn’t simply rely on generative AI to create suggested fixes for the developer. 

As security specialists, we understand the inherent limitations of generative AI. To address these challenges we created our proprietary multi-model AI, combining different AI methodologies to leverage their strengths and mitigate potential weaknesses. As a result, DeepCode AI Fix is more reliable than code-scanning auto-fixing solutions that solely rely on LLMs or single-model AI.

Additionally, Snyk Code’s DeepCode AI Fix is set up to ensure all its suggested fixes are automatically screened for security by Snyk Code’s rules-based symbolic AI before suggestions are presented to the developer. In other words, DeepCode AI Fix runs in the IDE, and Snyk Code automatically security-screens the former’s fix suggestions so, there is no need to build your code and manually scan it again after you’ve applied an auto-fix. From the start, developers can view fix suggestions, and apply their preferred fix with one click.

And finally, the cherry on the cake: DeepCode AI Fix’s LLM, like the rest of Snyk’s AI machine, is constantly improved, trained, and heavily fine-tuned by our security specialists, and is hosted by Snyk. While training DeepCode AI, Snyk ensures that we only use open source code with fixed vulnerabilities and permissive licenses, and we never train our AI on customer code. This means that all your security fixes will be highly reliable because they are laser-focused on code security alone (as you know by now, functional code and secure code are very different things) and don’t infringe any intellectual property rights. Snyk’s hosting of its own AI machine also means that your data will not be sent to a third party’s (e.g. OpenAI) servers, where control over your intellectual property and that of your customers, is out of your hands. Snyk does not keep customer data.

Faster and more accurate auto-fixing

DeepCode AI Fix also leads the auto-fixing market in speed and accuracy because of our constant improvement of DeepCode AI Fix’s LLM.

Snyk’s recent improvement of DeepCode AI Fix’s LLM model, and expansion of languages supported for OWASP Top 10 threats to eight languages (and counting!) have contributed to a leap in speed and accuracy. These improvements have also added extensive functionality. DeepCode AI Fix currently supports the following languages:

• JavaScript

• TypeScript

• Java

• Python

• C/C++ (Limited support)

• C# (Limited support)

• Go (Limited support)

• APEX (Limited support)

“Limited support” means that there’s currently support for under 10 rules covering the OWASP Top 10; and of these eight languages, Java, JavaScript, TypeScript, and Python will be generally available on October 29th, with the others available in early access. DeepCode AI Fix’s new experience will be available in VS Code and JetBrains IDEs, with broader support for other IDEs to follow.

In addition, our substantial investment in innovation future-proofs the Snyk DevSecOps platform and most recently resulted in CodeReduce, a patent-pending technology that significantly improved the performance of every major AI model tested, including OpenAI’s hugely popular GPT-4 model. 

CodeReduce first analyzes relevant code to see the portions impacted by the reported defect and what portions give context to this defect. It then prioritizes these relevant segments of code needed to perform the fix and focuses the DeepCode AI Fix’s attention mechanism here. This drastically reduces the amount of code that DeepCode AI Fix needs to process, which does two key things: 1) it helps improve fix suggestion quality and reduces hallucinations, and 2) it speeds up DeepCode AI Fix’s processing time. 

This futuristic and intelligent prioritization is how CodeReduce improved GPT-4’s accuracy by up to 20%, and is the reason for both DeepCode AI Fix’s industry-leading auto-fixing speed of mere seconds, and its ability to confidently fix vulnerabilities without creating additional security issues.

Accuracy Comparison:

Snyk outperforms other tools in terms of accuracy, generating precise fixes for various code analysis categories, with up to 20% improvement in most metrics.

Third: Prioritize intelligently

The last critical area modern code security tools should address is intelligent prioritization. The increasing number of security vulnerabilities, relative to the development pace necessitates a more intelligently targeted focus. While it’s relatively easy for a tool to present a host of security findings, this doesn’t present much value to the security team and can lead to developer fatigue. To be truly helpful, these tools must organize findings in order of priority for users.

Businesses have varying priorities, ways of working or set-ups, and risk profiles; an important risk to 70% of other organizations may not be important to yours. Snyk decided to tackle this nuanced area so that we can enable teams to focus on making the biggest impact with the smallest effort. At Snyk, we know that Only around 7% of all security issues are critical, so we believe that teams can achieve more in less time if we help them prioritize this 7%. 

Our unique approach to filtering out the noise is two-fold: we focus our efforts on reporting the more significant risks in Snyk Code scans, thus streamlining results for the user from the start; and we prioritize risk findings through Snyk Risk Score in Snyk Open Source and Snyk Container, leveraging a holistic approach for the highest accuracy.

Snyk Risk Score employs a combination of binary and probabilistic models to measure the likelihood of a vulnerability being exploited and its possible impact. It also considers multiple objective and contextual risk factors such as reachability, Exploit Maturity, EPSS, CVSS metrics, business criticality, etc.

Snyk’s reachable vulnerability analysis, powered by DeepCode AI, identifies whether an issue is related to functions being called by the application. This means that the issue has a higher risk of being exploited. Snyk’s AI-powered reachability can quickly analyze our Vulnerability Database to conduct relevant function analysis and create a call graph to determine if a vulnerable function from an open source package is being used in your application. This helps identify potential security risks. 

Reachability-backed Snyk Risk Score is currently available in open beta for Snyk Open Source and Snyk Container, and you can read more about Snyk’s reachability here.

In closing

In an increasingly complex and crowded application security space, Snyk recognizes this is not a street-by-street skirmish, embodied in numerous narrow point-solutions. Instead, this is an organized, structured battle that requires a consolidated, coordinated, and prioritized approach that draws all the different elements together in one platform and presents the vast quantities of data in a way that is meaningful and impactful for teams. 

As we leverage the power of AI not just to do what we did before faster and better, but also to give teams a modern way to work – with insights and efficiency, through prioritization.

Snyk Code’s code auto-fixing feature, DeepCode AI Fix, is generally available later this month on October 29th, and free for a limited time only. Switch it on by going to your settings and locating DeepCode AI Fix in the left-hand menu, then toggling it on as shown in the image below:

How to switch on DeepCode AI Fix, from within your Snyk settings

If you’re an existing Snyk Code customer, join our Customer Product Updates Webinar at the end of October, to see DeepCode AI Fix in action, showcasing its speed, accuracy, and ease of use, amongst other things. If you’re new to Snyk, exploring, or just need a refresher, we even have a new Snyk Learn lesson on how you can detect and auto-remediate issues rapidly, without context-switching, with Snyk Code in the IDE.

Curious about how Snyk, a Leader in 2023 Gartner® Magic Quadrant™ for Application Security Testing, empowers organizations to adopt AI safely, and want to experience AI-powered, intelligent finding, prioritizing, and fixing? Register for a Snyk account here and start experiencing a more proactive, easier, and more streamlined workflow, today.