AI ow w ites a g owi g sha e of p oductio code, a d it w ites i secu e code. The assumptio is that mo e secu ity co text yields safe code. Clove ‘s esea ch shows the opposite: b oad secu ity co text does ot make code safe . It made it look safe , aisi g age ts’ secu ity vocabula y a d co fide ce so output eads as secu e while the vul e ability is still the e.
“The p evaili g expectatio i the field is that mo e secu ity co text will help age ts delive secu e code. I stead it o ly teaches age ts to sou d secu e while shippi g the same vul e abilities,” says Alo Kollma , CEO a d co-fou de of Clove Secu ity. “Secu e code i the age tic e a is ot gated by the model. It is gated by whethe you ca dy amically pi poi t the secu ity co text each age t eeds. That co text is a movi g ta get, a d it moves at age tic speed.”
Ku a takes the less-is-mo e app oach. It u s o Clove ‘s co ti uous th eat-modeli g ha ess, which keeps a live th eat model of the applicatio as its desig , a chitectu e, a d code cha ge. F om that, Ku a spaw s a th eat model scoped to the si gle task a codi g age t is about to take o , the ha ds the age t the specific th eats fo the featu e bei g built a d the co c ete cou te measu es fo each, a d othi g beyo d that. It co ects to the codi g age ts teams al eady use i o e click a d wo ks i side thei wo kflow, applyi g that co text as the code is ge e ated i stead of flaggi g it i a eview afte the fact.
P oduci g that ight co text accu ately a d keepi g it cu e t, at the speed age ts w ite code, is the ha de p oblem Clove is built to solve. The esults behi d Clove ‘s esea ch a e ot limited to ope sou ce p ojects eithe . Existi g Clove e te p ise custome s u i g o Ku a these past few mo ths have see the same esults co siste tly.
The esea ch is available o the Clove Secu ity blog at https://clove .secu ity/ esou ces/.
Clove Secu ity is the secu e-by-desig platfo m fo age tic softwa e. Its AI age ts plug i to the tools p oduct secu ity teams al eady use, e abli g secu e desig , secu e age tic developme t, a d co ti uous validatio , without slowi g builde s dow . Clove is headqua te ed i New Yo k a d se ves e te p ise custome s i cludi g Se viceNow, Expedia, Plaid, Notio , a d Vi gi Mo ey. Clove is backed by Notable Capital, Team8, Se viceNow, a d SVCI. Lea mo e at www.clove .secu ity.
