Blog
Security writing from Corgea
Engineering-focused posts on code security, remediation workflows, and product updates.
Agents are now arguing in your pipelines
We read 4,007 developer replies to Corgea findings on pull requests. In October 2025 none of them came from an AI agent. By August 2026 almost half did, and the agents don't answer the way developers do. They dispute findings, accept the risk, and cite the code.
Changelog - October 22, 2026
This week's Corgea changelog focuses PR scans on the changes that matter, adds VB6 and VB.NET support, and makes Corgea Agent feedback easier to follow.
Changelog - October 15, 2026
This week's Corgea changelog adds a dedicated Corgea Agent permission, expands bulk status changes in the Workbench, and makes SCA package browsing faster.
Changelog - October 8, 2026
This week's Corgea changelog refines the Vulnerabilities Workbench, improves how SAST findings are tracked, and adds support for distinct CLI projects that share a repository.
Corgea Q3 2026 product update: AI pentesting, triage governance, and 52 releases
Corgea shipped 52 releases in Q3 2026: AI pentesting (beta), the Vulnerabilities Workbench, triage approvals, supply chain controls, and MCP support.
Changelog - September 24, 2026
This week's Corgea changelog adds file include rules, guided pentest target setup, and on-demand CycloneDX SBOM downloads.
See how Corgea fixes vulnerabilities
AI-powered scanning with auto-fix. Start securing your code in minutes.
Changelog - September 17, 2026
This week's Corgea changelog makes the Agent easier to reach, adds a daily digest for agent learning recommendations, and expands Advanced Vulnerability Search.
Changelog - September 10, 2026
This week's Corgea changelog adds API finding groups, a synchronous option for Generate Fix, and clearer reasons for false-positive and accepted-risk decisions.
Changelog - September 5, 2026
This week's Corgea changelog covers approval workflows for triage decisions, Bitbucket scan support, and a simpler way to connect AI agents to Corgea through MCP.
Changelog - August 27, 2026
This week's Corgea changelog post focuses on broader webhook coverage, richer SARIF exports for SCA findings, and private package registry support from the latest public releases in Corgea Docs.
Changelog - August 20, 2026
This week's Corgea changelog highlights private package registry support, Rust scanning coverage, and controlled bulk triage actions for agent workflows.
Changelog - August 13, 2026
This week's Corgea changelog highlights the new Vulnerability Workbench, bulk triage ingestion with approval workflows, and stronger sign-in resilience with email one-time passwords.
Changelog - August 6, 2026
This week's Corgea changelog highlights dynamic team access, scheduled IaC and container scans, and clearer failure diagnostics in scan API responses.
Changelog - July 30, 2026
This week's Corgea changelog highlights new Linear ticketing from findings, branded PDF exports for scan reports, and simpler self-service SSO group mapping.
Changelog - July 23, 2026
This week's Corgea changelog highlights better scan coverage visibility, malicious dependency blocking, and broader search and export workflows for SCA and IaC findings.
Changelog - July 16, 2026
This week's Corgea changelog post highlights the latest public release notes, including new reporting visibility into generated fixes and duplicate cleanup, plus more reliable GitHub pull request check updates.
Changelog - July 9, 2026
This week's Corgea changelog highlights new reporting visibility into fixes generated, cleaner duplicate triage reporting, and more reliable GitHub pull request check updates.
Checkmarx vs Veracode: Full Comparison + Why Teams Are Choosing Corgea
Compare Checkmarx and Veracode side by side on enterprise SAST, governance, developer workflow, remediation, and buying fit. See how Corgea stacks up.
Snyk vs Veracode: Full Comparison + Why Teams Are Choosing Corgea
Compare Snyk and Veracode side by side on security coverage, developer experience, governance, remediation workflow, and buying fit. See how Corgea stacks up.
The Crypto Wars are back, this time over AI models
Export controls failed to contain strong encryption in the 1990s. AI restrictions risk repeating the same mistake: binding defenders first while determined adversaries route around.
Corgea vs. Snyk: We benchmarked SAST on a deliberately vulnerable repo
On the same fixed benchmark basis as our Aikido comparison, Corgea found 42 of 47 confirmed issues and led on precision, recall, and F1. Snyk found 26, missing 21 of the confirmed set.
Corgea vs. Aikido: We benchmarked SAST on a deliberately vulnerable repo
Aikido was slightly more precise in this benchmark, but missed 34 of 47 confirmed issues. Corgea found 42, reached 89.36% recall, and delivered the stronger F1 score.
Changelog - July 2, 2026
This week's Corgea changelog highlights AI Penetration Testing, new dependency inventory workflows in the Corgea Agent, and better documentation for project-level scan exclusions.
Changelog - June 25, 2026
This week's Corgea changelog post highlights the latest public release notes, including the Skills Registry, policy API access, and bulk Content Access Management workflows.
We benchmarked 12 models on 1,913 real vulnerabilities. Here's the scoreboard.
There are public benchmarks for picking a model to drive a security scanner. The trouble is what they measure. CyberGym is C and C++ memory safety pulled from OSS-Fuzz, and the models being graded have most likely trained on it by now.
Changelog - June 18, 2026
This week's Corgea changelog highlights the new Skills Registry, policy API access, and SLA-aware vulnerability search.
Introducing Corgea AI Pentesting
Autonomous penetration testing that thinks like a pentesting team. Multi-agent architecture. Code-aware, not black-box. 4-8 hours instead of 2 weeks.
Corgea Auto-Discovery and Learning
Corgea now studies your codebase before scanning it, and learns from every developer feedback action. No more generic scanners. No more repeating the same false positives.
Introducing Corgea Skill Scanning
Corgea scans custom agent skills before developers can install them, blocking unsafe SKILL.md instructions and distributing only approved versions through the governed Skills Registry.
Introducing Corgea Security Design Reviews
Most security tools only find bugs after they're written. Corgea Security Design Reviews catch design-level risks before a single line of code is committed.
Changelog - June 11, 2026
This week's Corgea changelog highlights on-demand fix generation, branch-level reporting filters, and richer SCA advisory details.
Changelog - June 4, 2026
This week's Corgea changelog highlights faster project tag management, more resilient large scan uploads, and more reliable GitHub App pull request scanning.
Best SonarQube Alternatives in 2026: 10 Tools Compared (Free & Paid)
The best SonarQube alternatives in 2026: 10 free and paid tools compared on security accuracy, auto-fix, coverage, and pricing, plus a complete open-source SonarQube replacement stack.
Changelog - May 28, 2026
This week's Corgea changelog highlights SCA support in SLA Management, Security Design Review beta, and broader API and MCP access to security data.
Changelog - May 21, 2026
This week's Corgea changelog highlights scheduled scan webhook filters, project-tag scoped PR rules, and broader, cleaner scan analysis.
Changelog - May 13, 2026
This week's Corgea changelog highlights Harness Code integration, sharper secret scanning, and stronger endpoint discovery in the scanning engine.
SonarQube vs Snyk: Full Comparison + Why Teams Are Choosing Corgea
Compare SonarQube and Snyk side by side on security coverage, developer experience, accuracy, pricing, and auto-remediation. See how Corgea stacks up.
Snyk vs Checkmarx: Full Comparison + Why Teams Are Choosing Corgea
Compare Snyk and Checkmarx side by side on security coverage, developer experience, accuracy, pricing, and auto-remediation. See how Corgea stacks up.
SonarQube vs Checkmarx: Full Comparison + Why Teams Are Choosing Corgea
Compare SonarQube and Checkmarx side by side on security coverage, developer experience, accuracy, pricing, and auto-remediation. See how Corgea stacks up.
SonarQube vs Veracode: Full Comparison + Why Teams Are Choosing Corgea
Compare SonarQube and Veracode side by side on security coverage, developer experience, accuracy, pricing, and auto-remediation. See how Corgea stacks up.
Mythos: Given Enough Inference, All Bugs Are Shallow
Anthropic's Mythos showed that given enough inference, all bugs are shallow. But who pays for the inference? We benchmarked Claude Opus 4.6 against Corgea v1 and v2 to show why purpose-built scanner architecture beats raw model capability on precision, recall, cost, and speed.
Snyk vs Semgrep: Full Comparison + Why Teams Are Choosing Corgea
Compare Snyk and Semgrep side by side on security coverage, developer experience, accuracy, pricing, and auto-remediation. See how Corgea stacks up.
Corgea Reporting: Security and Developer Insights in One View
Track code, dependency, code quality, IaC, scan activity, aging, and developer insights in one place. Filter reporting by project, tags, and time to see trends clearly.
New Integration: Bitbucket
Connect Corgea to Bitbucket in a day with an API-native integration—no CI/CD setup. Scan repos, get PR feedback, use Corgea Agent in Bitbucket, and open fix pull requests automa...
New in Corgea: Container Scanning + IaC Scanning
Scan container images for known CVEs and catch IaC misconfigurations before deploy. Corgea adds container/image scanning and Infrastructure as Code scanning for AppSec and devel...
New Feature: Corgea Agent
Corgea Agent brings security into pull requests so developers can triage findings without leaving their workflow. Security teams get auditable feedback history and insights in t...
New Product: Code Quality
Code Quality in Corgea finds high-confidence code quality issues using multi-file context and CWE-based categorization, with optional automated fixes. Try it now or book a demo.
AI Application Security: How AI Is Transforming AppSec in 2026
Codebases are growing faster than security headcount, scanner output is a firehose of noise, and developers treat security findings like spam. AI application security is the fir...
13 Best Java Static Code Analysis Tools in 2026 (Ranked)
The best Java static code analysis tools for security, code quality and CI/CD in 2026, with a comparison table, framework awareness, auto-fix and pricing.
Here's what happening the last 72-hours: 700+ Packages Compromised from Shai-Hulud 2.0 Worm (November 25, 2025)
Critical npm worm compromises 700+ packages including Zapier, PostHog, and Postman. 25,000+ GitHub repos infected, exposing 775+ tokens. Immediate mitigation steps inside.
Sha1-Hulud: The Second Wave of npm Supply-Chain Attacks
Researchers uncovered a fast-moving npm supply-chain worm named Shai-Hulud. The malware injected malicious JavaScript (bundle.js) into popular packages.
Introducing Smarter Auto-Fixing for SAST Findings
Corgea’s improved auto-fixing now delivers self-healing fixes, stronger quality checks, and 8% higher accuracy. Supports HTML, JSP, and integrates with Checkmarx, Fortify, Semgr...
Introducing Extended APIs: Enhanced Security Management for Developers
Discover Corgea's new Extended APIs for scans, issues, blocking rules, and scan operations. Automate security workflows, integrate with CI/CD pipelines, and build custom securit...
Introducing Corgea Dependency Scanning
Stay ahead of open-source risks with Corgea’s new Dependency Scanning. Automatically detect vulnerabilities, enforce licenses, and apply grouped fix versions across multiple eco...
Announcing Reachability Analysis: Endpoint-Aware SAST in Corgea
Corgea’s new Reachability Analysis connects SAST findings to real web endpoints, showing which vulnerabilities are actually reachable from your API surface. Automatically maps e...
Automate Your Security: Introducing Corgea's Scheduled Scans
Automate your security workflows with Corgea's new Scheduled Scans feature. Set up recurring SAST, SCA, secrets, and PII scans across projects with flexible scheduling, intellig...
The Three Waves of SAST: From Rules to AI-Native Analysis
Explore the evolution of Static Application Security Testing (SAST) — from legacy Fortify and Checkmarx, to developer-first tools like Snyk and Semgrep, and now AI-native SAST r...
Whitepaper: JavaScript Security Scanning
How Corgea AI SAST classifies JavaScript as frontend or backend before scanning, so DOM XSS, injection, and logic flaws surface with fewer false positives.
Introducing the new Scan Details Page
Corgea’s Scan Details page gives security teams deep insight and control with an interactive dashboard to analyze and manage code vulnerabilities effectively.
Introducing Source and Sink Tracing for Smarter Security
Corgea’s Source & Sink Analysis maps untrusted data flow end-to-end, bringing intelligent, enterprise-grade vulnerability analysis to your development workflow.
Improved Multi-File Analysis and False Positive Reduction
Corgea’s upgraded multi-file analysis engine redefines static analysis by mapping your codebase context, analyzing file relationships, and understanding true system behavior.
Introducing Policy YAML: Security Policies as Code, Built for Scale
Corgea’s Policy-as-Code lets you define and enforce security standards as YAML in your repo, turning policies into actionable, automated code.
AI-Powered Policy Creation, Optimization, and Testing — All in One Place
Corgea’s Policy Playground & Optimizer empower security teams to craft AI-enhanced policies that catch real issues and cut noise, all in one seamless environment.
Introducing BLAST: The Future of Security Testing is Here
Corgea launches BLAST: an AI-powered platform to uncover and fix hidden business logic vulnerabilities, protecting enterprises from advanced cyber threats.
Corgea Named Best SAST Auto-Fixing Solution in Recent Analyst Report
We’re excited to share that Corgea has been recognized as the best SAST auto-fixing solution in the latest Actually Useful Product Guide report for Q1 2025. This recognition val...
Streamline Security Response with Corgea's New SLA Management
Effective security requires more than just finding vulnerabilities - it's about having processes in place to prioritize and respond to issues based on their severity and potenti...
Introducing PolicyIQ: Contextual Security Analysis for Smarter, More Accurate Results
Corgea is excited to announce the release of PolicyIQ, a groundbreaking new feature that addresses the limitations of traditional static application security testing (SAST) tool...
Announcing Beagle: The Next Generation of AppSec LLMs
We are proud to introduce Beagle, the latest version of Corgea's fine-tuned AppSec LLM. Beagle represents a groundbreaking leap in automated vulnerability management, combining...
New Integrations for Streamlined Workflows
We're thrilled to announce the release of our new integrations for JIRA, Slack, Zapier, and webhooks! These powerful integrations are designed to seamlessly integrate Corgea int...
Corgea Announces GitLab Integration
Corgea, the leading automated code security platform, is excited to announce its integration with GitLab, the popular web-based DevOps lifecycle tool. This integration allows de...
Corgea Expands Language Support: C, C++, Kotlin, and PHP for Enhanced Code Security
Corgea is excited to announce the expansion of its language support to include C, C++, Kotlin, and PHP. We know how critical comprehensive language and framework support is for...
Whitepaper: BLAST, the AI-powered SAST scanner
Corgea: AI-powered app security that detects hidden flaws, cuts false positives by 30%, and accelerates fixes by 80%. Built for secure, fast devs.
Introducing Corgea CodeIQ: Smarter Detection, Triaging, and Fixing of Insecure Code
Introducing Corgea CodeIQ: Understand your codebase deeply, map code to the broader system, and revolutionize secure code analysis for developers and security teams.
The Future of SAST: A Shift to AI-Powered Security
Static Application Security Testing (SAST) has long been a foundational tool in the arsenal of software security. Designed to scrutinize codebases and identify vulnerabilities b...
Corgea Announces Integration with Fortify to Enhance Application Security for Enterprises
Corgea partners with Fortify to bring AI-driven triage and remediation to enterprise SAST, helping complex organizations strengthen app security at scale.
Corgea Recognized as an IDC Innovator for DevSecOps Automated Remediation
Corgea named an IDC Innovator for DevSecOps Automated Remediation, recognized for pioneering AI-driven secure code automation and innovation.
Introducing Corgea's New Visual Studio 2022 Plugin: AI-Generated Fixes for Developers
Corgea for Visual Studio 2022: Identify, analyze, and fix code vulnerabilities seamlessly with powerful in-editor security management.
Introducing Corgea's AppSec LLM: Precision, Privacy, and Performance for Enterprise Security
Introducing Corgea’s AppSec LLM: a private, enterprise-grade language model delivering precise vulnerability detection and secure, privacy-focused remediation.
New Product: BLAST - Business Logic Application Security Testing
Corgea launches BLAST: Business Logic Application Security Testing to help devs and security teams uncover critical business logic flaws in apps.
Fine-Tuning for Precision and Privacy: How Corgea's LLM Enhances Enterprise Application Security
Corgea: AI-powered AppSec engineer for enterprises, cutting false positives by 30% and speeding remediation by 80% with secure, private fine-tuned models.
How Corgea Improves Fix Accuracy and Coverage?
Corgea explains how its AI-driven platform improves SAST fix accuracy and coverage, delivering precise code fixes and reducing false positives for developers.
Introducing Corgea Reporting
Corgea launches a powerful reporting feature for AppSec and software engineers to track security posture, spot patterns, and drive measurable savings.
Introducing: Corgea's Advanced False Positive Detection
Corgea introduces Advanced False Positive Detection for SAST, helping developers and security teams save time by reducing noise and focusing on real issues.
Introducing Corgea's New Visual Studio Code Plugin: AI-Generated Fixes
Boost productivity & secure your code with Corgea's Visual Studio IDE Plugin. Detect & fix vulnerabilities automatically with AI-generated fixes.
Corgea Integration with Azure DevOps: Enhancing Code Security Through AI
Corgea now integrates with Azure DevOps, enabling seamless, AI-powered code correction and security directly in your DevOps workflows.
Announcing Corgea's GitHub App for automated PR fixes
Corgea’s GitHub app brings enterprise-level security to small teams by detecting vulnerabilities and suggesting fixes—like your own in-house security engineer
Corgea's New GitHub Action
Corgea now integrates with GitHub Actions, empowering developers to detect and fix vulnerable code seamlessly within their CI/CD workflow.
Announcing New Language Support: C# and .Net for Automated Vulnerability Fixes
Corgea now supports automated code fixes for C# and .NET apps, extending our commitment to secure development across popular languages and frameworks.
Corgea Announces New Integration with CodeQL Reports to Streamline Security Fixes
Corgea now supports fixing CodeQL-detected vulnerabilities with seamless, automated remediation integrated directly into your workflow.
Corgea Now Supports Vulnerability Fixes in Java, Go, and Ruby
Corgea expands automated code fixes to Java, Go, and Ruby, ensuring comprehensive security coverage for widely-used programming languages.
Introducing "Corgea's GitHub App"
Corgea launches its GitHub App, delivering automated vulnerability patches via pull requests—seamlessly integrated into your team’s development workflow.
Introducing "Download Fix"
Corgea’s new 'Download Fix' feature lets developers instantly download patches for vulnerabilities detected by SAST tools like Snyk and Semgrep."
How does Corgea work?
Corgea connects to SAST tools like Snyk & Semgrep, writes AI-powered fixes with explanations, saving security teams 80% effort & speeding up patching.
Introducing Corgea
Corgea launches! Automatically secure vulnerable source code with AI-powered fixes, reducing effort by 80% and accelerating secure development.
No matching content found.