[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6gNVrxxqFbgZTiQwW92Owqs7wG5aQGlFSzaCRLfajc0":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"1ac5e497-b8fc-4ffd-961c-1e7790cfb7ca","Black Duck Adds AI-Powered Triage and CRA-Ready Checks to Coverity Static Analysis","black-duck-adds-ai-powered-triage-and-cra-ready-checks-to-coverity-static-analys-700651","Black Duck has rolled out a set of AI-driven and compliance-focused updates to Coverity, its static application security testing (SAST) tool, as the application security vendor looks to align the two-decade-old product with both the rise of AI-assisted coding and tightening European regulation. The release marks the first time AI-powered features have shipped in Coverity, […] The post Black Duck Adds AI-Powered Triage and CRA-Ready Checks to Coverity Static Analysis appeared first on IT Security Guru.","Black Duck has enhanced its Coverity static application security testing (SAST) tool with AI-driven features for issue triage and compliance checks, particularly aligning with the EU's Cyber Resilience Act (CRA). The updates include AI-assisted false positive reduction, integration with AI coding agents via a Model Context Protocol server, and new checks for vulnerabilities like IDOR. The company emphasizes customer control over data processing by allowing local LLM deployment.","Black Duck updates Coverity SAST tool with AI-powered triage and CRA-ready checks.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F07\u002F14\u002Fblack-duck-adds-ai-powered-triage-and-cra-ready-checks-to-coverity-static-analysis\u002F?utm_source=rss&utm_medium=rss&utm_campaign=black-duck-adds-ai-powered-triage-and-cra-ready-checks-to-coverity-static-analysis","https:\u002F\u002Fwww.itsecurityguru.org\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FChatGPT-Image-Jul-14-2026-01_28_10-PM.png","2026-07-14T12:29:25+00:00","2026-07-15T12:00:17.545529+00:00",7,[17,20,23,26,28],{"name":18,"type":19},"Coverity","product",{"name":21,"type":22},"Black Duck","vendor",{"name":24,"type":25},"SAST","technology",{"name":27,"type":25},"LLM",{"name":29,"type":25},"AI","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":30,"icon":32,"name":33,"slug":34},null,"Tools","tools",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[54],{"type":55,"value":56,"context":57},"malware","IDOR","AI-powered detection of Insecure Direct Object Reference (IDOR) flaws",[21,18],{"controls":60,"vendors":144},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":47,"name":91,"problem":92,"products":93},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"slug":119,"name":120,"problem":121,"products":122},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":140,"product_name":141,"url":142,"description":143},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"ai-enhanced-sast-and-cra-compliance-reshape-secure-development-practices","AI-Enhanced SAST and CRA Compliance Reshape Secure Development Practices","As software complexity grows, manual vulnerability triage in static analysis tools becomes a bottleneck, leading to alert fatigue and overlooked defects like IDOR vulnerabilities. Black Duck's AI-powered enhancements to Coverity address this by reducing false positives and accelerating developer remediation workflows. The alignment with the EU Cyber Resilience Act (CRA) signals that regulatory pressure is now directly shaping tooling requirements for software vendors selling into European markets. Organizations that fail to integrate SAST tooling with compliance frameworks risk both insecure codebases and regulatory penalties. The option for local LLM deployment also reflects growing concerns about data sovereignty when AI processes proprietary source code.",[150,151,152,153,154,155,156],"CIS Control 16 - Application Software Security","NIST SP 800-218 (SSDF) - Secure Software Development Framework","NIST SA-11 - Developer Testing and Evaluation","EU Cyber Resilience Act (CRA) - Articles 13 & 14 (Security Requirements for Products with Digital Elements)","OWASP SAMM - Verification Practice","ISO\u002FIEC 27034 - Application Security","GDPR Article 25 - Data Protection by Design and by Default",{}]