Snyk Blog In this article One connected defense: Discover, Remediate, Validate, Prevent The problem: attackers moved up the stack, and testing didn't follow AI changes the math, not the discipline Evo Continuous Offensive Security, generally available Completing the defense: Discover, Remediate, Prevent Discover - Enhanced AI Security Posture Management Remediate - Evo Agentic AppSec: a first look at what's next Prevent - Snyk Secrets, now generally available Why it matters Availability Evo Continuous Offensive Security Is Here Pentesting Grade Coverage For The 350 Days A Year You Aren'T Testing Written by Snyk Team August 3, 2026 0 mins read At Black Hat USA 2026, Snyk brings Evo Continuous Offensive Security to general availability: autonomous, AI-powered pentesting that closes the gap between your once-or-twice-a-year pentest and the 350 days a year attackers never stop. COS is the new hero of one connected defense, built to answer the question every board is now asking: how do we prepare for autonomous AI attacks ? It’s no longer news that AI has thoroughly rewritten the way software is built. The code that used to take days to ship now takes minutes, and we're all benefiting from AI coding assistants and, increasingly, from autonomous agents working side by side. But with that great power comes the great responsibility of coping with that level of acceleration, which is doing something to security teams that they're only beginning to reckon with now: the greatly expanded surface attackers can now target, while being given the same reasoning-capable AI that developers are using to build that fast. The reckoning is also in the fact that the surface now spans three fronts at once: architectural flaws that only reasoning-capable systems can find, credentials leaking from AI-generated code, and models and agents now embedded directly in the development lifecycle. And adversaries are now probing all three simultaneously at machine speed. In June, the Five Eyes Alliance warned that AI is on track to bypass current cybersecurity capabilities in months, not years, with adversary breakout time now measured in seconds. Gartner forecasts the window to exploitation will be cut in half by 2027, while Snyk's own latest research into enterprise AI adoption tells the same story, but from the inside: agentic development is accelerating faster than security programs can track it. Defending against all that takes four things, not one. Today, at Black Hat USA 2026, Snyk is responding to that shift with its broadest expansion of the Snyk AI Security Platform to date. Not with a bundle of products, but with a connected defense organized around the four steps organizations need to innovate securely: discover the full attack surface, remediate the inherited backlog, validate what an attacker can truly exploit, and prevent new risk from rebuilding it. Leading it is the general availability of Evo Continuous Offensive Security (COS) : autonomous, AI-powered pentesting that keeps pace with AI-accelerated development. Alongside it, Snyk is announcing enhanced AI Security Posture Management, a first look at Evo Agentic Application Security, and the general availability of Snyk Secrets. Together, these secure the full lifecycle of AI-accelerated software: how it's built, what it's built from, and how it's attacked . One connected defense: Discover, Remediate, Validate, Prevent One connected defense is table stakes against an attacker who now reasons about your application at machine speed, for the price of tokens: Discover : see the full software and AI attack surface: models, agents, MCP servers, skills, tools, and what each can reach. The first step is delivered by AI-SPM, the AI-BOM, and the Snyk AI Security platform. Remediate : clear the inherited backlog before autonomous attackers work through it faster than people can respond. This step is delivered by Snyk’s application intelligence and autonomous remediation. Validate : continuously attack applications to prove fixes held, show what’s still exploitable, and surface the architectural and business-logic flaws no scanner reaches. This step is delivered by Evo COS. Prevent : stop secrets, malicious packages, and new vulnerabilities from rebuilding the backlog as humans and agents write software. Finally, this is delivered by Snyk Secrets, prevention gates, and malicious code defense. Because Snyk already understands the code, the dependencies, the APIs, the AI components, and the development context, each capability makes the others sharper instead of adding one more disconnected tool. That’s the difference between a platform and a bundle. The problem: attackers moved up the stack, and testing didn't follow For over two decades now, one distinction has held true in application security: scanners find the implementation-level bugs, and human pentesters find the architectural flaws. Automated scanners became genuinely excellent at the first category, finding SQL injection, cross-site scripting, misconfigurations, and the injection and pattern classes visible in code. Hundreds of vulnerability classes are now caught reliably across the software lifecycle. That's a real and durable win, and it isn't going anywhere. But attackers have moved up the stack, toward the design-level flaws that require understanding what an application is designed to do before you can exploit it. These live in a system's trust relationships, not in its code, so they don't have a signature you can scan for. Consider the shape of them: In 2019, First American exposed roughly 885 million financial documents . It didn’t happen through malware or a zero-day, but by changing a single number in a URL. Every scanner ran clean, and the application did exactly what its code said. It just wasn't supposed to let one customer read another's documents. In January 2026, researchers disclosed BodySnatcher (CVE-2025-12420, CVSS 9.3) : a single email address was enough to impersonate any ServiceNow administrator and take over the platform's AI agents. No passwords were hacked, there was no exploit code, but what was there, in fact, was just a design that trusted the wrong thing. This is the class attackers are exploiting now: Broken Object-Level Authorization (BOLA) and privilege escalation by manipulating identifiers, cross-tenant leakage that exfiltrates customer data, and chained business-logic attacks where a few low-severity issues combine into account takeover. A decade of dormant lows and mediums, plus every new finding, is now reachable and chainable at machine speed. And you cannot write a scanner rule for "user A should not be able to read user B's invoice," because that rule depends entirely on what the application is supposed to do. Finding these flaws has always required human reasoning, which is why it has always meant having a manual penetration test. And manual pentesting is irreplaceable, but it is bound by human time. A typical engagement runs 15 days and costs anything from $20,000 to $100,000, while it captures a single point in time. The coverage window closes the moment the report ships, by which point the application has already shipped several more releases. Your pentest covers roughly 15 days a year. What's happening the other 350? Development doesn't stop, and neither do attackers. Every release that ships in that window goes untested at exactly the layer where the highest-impact risk lives. AI changes the math, not the discipline Here's what actually changed. The reasoning step that only a human pentester could perform, modeling an application's intent, then figuring out how to subvert it, is now something a sufficiently capable model can perform too, repeatably, at a fraction of the cost. The discipline is the same, but the economics are definitely not. The proof is already public and at scale. In the year to mid-2026, valid AI-generated vulnerability reports to HackerOne rose 210%, with prompt-injection reports up 540%, a surge concentrated in exactly the reasoning-dependent flaws scanners can't see. The reasoning line that held for twenty years didn't erode gradually; it fell in the space of a model generation. The truly uncomfortable corollary is that attackers crossed the same line at the same moment, and they're already operating end to end. In one state-sponsored cyber-espionage campaign disclosed in late 2025, as much as 90% of the operation was executed by AI rather than human hackers ( Anthropic Threat Intelligence, November 2025 ). The question stopped being whether AI can find and exploit the flaws that scanners miss, rather whether your offensive security testing finds them before an attacker does. Evo Continuous Offensive Security, generally available We developed Evo Continuous Offensive Security to close that very gap. It's an AI-powered pentesting capability built on an enterprise-grade AI harness that reasons about application intent to uncover the architectural flaws and business-logic vulnerabilities traditional scanners miss. And it runs continuously, not once a year. Crucially, COS does not test blind. Because it's part of the Snyk AI Security Platform, it receives context from existing Snyk Code, Snyk Open Source, and Snyk API & Web findings – as well as Evo AI-SPM, with additional insights for testing AI-native apps.. That means it directs its reasoning toward flaws those tools can't catch, rather than spending expensive model cycles rediscovering the vulnerabilities they already found. As our team puts it: if a bug is worth $1 and a flaw is worth $100, why spend pentest cycles rediscovering $1 bugs ? The capability is delivered through three integrated pieces that work as one continuous offensive program, with reasoning where it counts, exhaustive where it pays, and purpose-built for the new AI attack surface: Reason like an attacker - AI Pentesting is the brain of COS. It self-scopes, plans a multi-stage attack, and validates exploitability, orchestrating the specialized