Black Duck adds AI features to Coverity for EU Cyber Resilience Act

Static analysis may not be glamorous, but it’s where a lot of real software-supply-chain risk actually lives. Black Duck’s move to pair deterministic Coverity analysis with AI‑assisted triage and MCP integration is a good example of how classical AppSec is being upgraded to cope with both more complex software and more demanding regulation, particularly in Europe.

The mention of EU Cyber Resilience Act readiness is key: CRA will effectively force product makers shipping into the EU to treat security as a lifecycle responsibility, not a one‑off. Tools that can prove both thorough code scanning and efficient handling of findings will become table stakes. Adding AI on top of a mature static engine is a way to scale scarce security talent without surrendering auditability to opaque models.

For the AGI race, this sits in the “defensive infrastructure” bucket. As AI systems generate more code and attackers use AI to find exploits, the only sustainable equilibrium is massively better automated assurance. Investments in AI‑enhanced but explainable security tooling like this won’t directly create smarter models, but they’re vital for keeping increasingly autonomous software from becoming an unmanageable attack surface.