Black Duck Adds AI-Powered Triage and CRA-Ready Checks to Coverity Static Analysis
Black Duck updates Coverity SAST tool with AI-powered triage and CRA-ready checks.
Black Duck has enhanced its Coverity static application security testing (SAST) tool with AI-driven features for issue triage and compliance checks, particularly aligning with the EU's Cyber Resilience Act (CRA). The updates include AI-assisted false positive reduction, integration with AI coding agents via a Model Context Protocol server, and new checks for vulnerabilities like IDOR. The company emphasizes customer control over data processing by allowing local LLM deployment.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Black Duck?
Get an email when a new story names Black Duck, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAs software complexity grows, manual vulnerability triage in static analysis tools becomes a bottleneck, leading to alert fatigue and overlooked defects like IDOR vulnerabilities. Black Duck's AI-powered enhancements to Coverity address this by reducing false positives and accelerating developer remediation workflows. The alignment with the EU Cyber Resilience Act (CRA) signals that regulatory pressure is now directly shaping tooling requirements for software vendors selling into European markets. Organizations that fail to integrate SAST tooling with compliance frameworks risk both insecure codebases and regulatory penalties. The option for local LLM deployment also reflects growing concerns about data sovereignty when AI processes proprietary source code.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — IDOR