Checkmarx has overhauled its Checkmarx One platform with an orchestration framework that manages five AI agents covering vulnerability discovery, triage, and remediation across the full development pipeline, from IDE to production.
<h2>What’s new</h2>
Two new agents are the headline additions. Triage Assist autonomously prioritizes vulnerabilities, cutting down the manual work of sorting through findings. Remediation Assist generates code fixes before changes merge, so issues get addressed earlier in the process rather than after deployment.
On the AI asset side, a new AI Supply Chain Security capability tracks models, agents, datasets, prompts, and AI-BOM components, then enforces policy against them. The idea is that as teams pull in more third-party AI components, someone needs to know what’s actually running in the stack.
Checkmarx also updated its static and dynamic analysis tools. AI SAST uses LLMs to find vulnerabilities in AI-generated code, which tends to have different patterns than human-written code. DAST for AI adds dynamic runtime analysis for AI-specific attack surfaces.
<h2>The framing</h2>
Checkmarx is pitching this as a response to an AI arms race: developers ship code faster with AI assistance, which means more code, more vulnerabilities, and less time to catch them before attackers do. Their argument is that deterministic rules alone can’t keep pace, so security tooling needs to combine those rules with LLMs running at machine speed.
Whether you buy the arms-race framing or not, the underlying problem is real. AI-generated code is increasing the volume of what security teams need to review, and the traditional software development lifecycle wasn’t designed with that volume in mind. The new agents are Checkmarx’s answer to that gap.

Collections

Checkmarx has updated its One platform with an AI agent orchestration framework featuring five agents for vulnerability triage and remediation. New additions include Triage Assist for autonomous vulnerability prioritization and Remediation Assist for generating code fixes pre-merge. An AI Supply Chain Security capability tracks AI models, datasets, prompts, and AI-BOM components with policy enforcement. Updated SAST and DAST tools now target AI-generated code patterns and AI-specific runtime attack surfaces. The platform positions itself as a response to the increased code volume and vulnerability surface created by AI-assisted development.

Checkmarx One gets AI agents for vulnerability triage, remediation, and AI asset tracking