How Snyk incorporates generative AI into the platform
How Snyk uses generative AI across its platform, including the third-party models that power its AI features
Snyk's AI Security Platform uses generative AI to enhance automation, efficiency, and innovation for developers and security teams. Snyk's generative AI features are powered by third-party large language models (LLMs) from established AI providers.
This document explains what generative AI technologies Snyk uses and how data flows through our systems. It also describes the measures we take to protect your data. The field of AI is changing quickly. As a result, the AI technologies we use may change when we introduce new features or update existing ones.
Core principles
Snyk places the utmost importance on data security and integrity.
No training on customer code: Snyk does not use customer proprietary software code to train, optimize, fine-tune, or improve any AI models, and does not use or incorporate any third-party AI models into the platform unless they make the same commitments.
Contractual protection: All of the AI functionality described in this document forms part of Snyk's services. Your use of this functionality is governed by your existing agreements with Snyk and benefits from the same contractual protections. No separate in-service terms, addenda, or amendments to your existing agreements with Snyk are required.
AI models
Snyk uses LLMs from established AI providers, including OpenAI and Anthropic, through API connections and cloud services like AWS Bedrock and GCP Vertex.
Product-specific AI implementations
Agent Fix & Explain
Purpose
Designed to help developers:
Fix their code faster by suggesting fixes to vulnerabilities identified by Snyk Code; and
Better understand findings and suggestions returned by Snyk by providing detailed explanations on demand.
AI models / deployment
Anthropic's Claude models through AWS Bedrock or GCP Vertex.
Data processed
Code snippets containing only the relevant scope of the vulnerability.
Additional information
More information about Agent Fix is available here.
Snyk Assist for Snyk Learn
Purpose
AI powered chat assistant designed to help developers and Snyk users:
Obtain contextually relevant assistance when navigating the information and resources available within Snyk Learn; and
Get immediate customized answers to specific application security, secure coding and Snyk product usage questions.
AI models / deployment
Anthropic's Claude models through GCP Vertex.
Data Processed
User input, in the form of chat-based questions submitted by developers and Snyk users.
Safeguards
Snyk has implemented:
Technical safeguards designed to check for code in user input — if found, code is not sent to the AI model or stored by Snyk.
Measures designed to handle inappropriate user input, for your safety and that of Snyk.
Additional information
More information about Snyk Assist for Learn is available here.
Snyk Assist for Support
Purpose
AI-powered assistant designed to help users obtain support through the enterprise search and virtual agent capabilities within the Snyk support portal.
AI models / deployment
OpenAI, accessed through secure API connections, for question moderation only; Anthropic's models through GCP Vertex for answer generation.
Data Processed
For question moderation: User input in the form of chat-based questions (i.e. question text only); and
For answer generation: User input in the form of chat-based questions, and limited user context including user email, account name, account type, and group name.
Additional information
Snyk Assist for Support is available here.
Snyk API & Web (False Positive Reduction (FPR))
Purpose
Designed to help classify findings to reduce manual review and improve efficiency.
AI models / deployment
Anthropic's Claude models through AWS Bedrock.
Data Processed
Parts of HTTP requests and responses (i.e. components of web communications that are analyzed to detect and classify vulnerabilities).
Additional information
More information about Snyk API & Web is available here.
Snyk API & Web - Broken Object Level Authorization for APIs
Purpose
Designed to help identify authorization vulnerabilities in APIs, including Broken Object Level Authorization.
AI models / deployment
Anthropic's Claude models through AWS Bedrock.
Data processed
Parts of HTTP requests and responses (i.e. components of web communications that are analyzed to detect vulnerabilities and classify content).
Additional information
More information about Snyk API & Web is available here.
Snyk SAST / DAST Correlation
Purpose
Designed to correlate Snyk Code and Snyk API & Web findings by highlighting the source code that triggered a given API & Web Vulnerability.
AI models / deployment
Google's Gemini and Anthropic's Claude models through AWS Bedrock and GCP Vertex.
Data Processed
Customer source code; DAST scan information (for example, vulnerability types, endpoints, and parameters); and SAST scan information (for example, vulnerability types, file names, and code locations), to help correlate source code with runtime vulnerabilities.
Additional information
More information about Snyk API & Web is available here.
AI-SPM
Evo Chat Agent
Purpose
AI-powered security assistant designed to help users explore the data available to them as part of AI-SPM (e.g. understanding AI assets, policy results, creating and updated policies, generating basic reporting).
AI models / deployment
Google's Gemini and Anthropic's Claude models through GCP Vertex and AWS Bedrock (depending on the deployment region).
Data processed
User context (user ID, tenant ID, and authentication token) used to scope requests and authorise downstream API calls.
User chat messages and agent responses within a session.
AI asset metadata (e.g. model name, type, vendor, repository, organisation), asset relationships, security policies, and policy violation issues.
Additional information
More information about Evo Chat Agent is available via the Customer portal.
Evo AI-BOM Pattern Detection
Purpose
Allows the EVO AI-BOM to detect customer-specific AI assets, such as fine-tuned models.
AI models / deployment
Anthropic's Claude models through GCP Vertex or AWS Bedrock.
Data processed
Code snippets used to label whether patterns are AI assets.
Additional information
More information about Evo AI-BOM Pattern Detection is available via the Customer portal.
Evo AI-BOM Agentic Enrichment
Purpose
AI-powered agent that operates in two parts: (1) Agentic Discovery - discovers first-party AI components (agents, tools, MCP servers/clients/resources, models) and the relations between them that static analysis misses; (2) Agentic Metadata Gathering - extracts tool descriptions and agent system prompts from already-discovered components by reading their source code.
AI models / deployment
Anthropic's Claude models through GCP Vertex or AWS Bedrock.
Data processed
Repository source code
Existing inventory of AI components and relations from static analysis
Source code locations of already-discovered tools and agents for metadata extraction
Additional information
More information about Evo AI-BOM Agentic Enrichment is available via the Customer portal.
Agentic Development Security (ADS)
Agent supply chain security
Purpose
Inventory and risk assessment of AI assets across developer machines: MCP servers, skills, and agent tooling.
AI models / deployment
Google's Gemini, OpenAI, and Anthropic's Claude models through GCP Vertex and AWS Bedrock (depending on the deployment region).
Data processed
MCP server configuration files, MCP client-server handshake output, SKILL files. Snyk redacts secrets before content leaves the Snyk environment.
Additional information
Visit the Agent supply chain security documentation.
Agent Behavior
Purpose
Designed to monitor agent actions and apply governance policies during execution.
AI models / deployment
Google's Gemini, OpenAI, and Anthropic's Claude models through GCP Vertex and AWS Bedrock (depending on the deployment region).
Data processed
Code snippets containing only the relevant scope of the vulnerability. Parts of customer code and agent commands (that is, components of agent runtime that are analyzed to detect and classify vulnerabilities).
Additional information
Visit the Agent Behavior documentation.
Continuous Offensive Security (COS) - AI Pentesting Solution
Purpose
AI-driven engine designed to deploy autonomous agents to assess web applications and APIs, reasoning about business logic, chaining vulnerabilities, and producing exploit-proven findings with Python proof-of-concept code and LLM reasoning traces.
AI models / deployment
Anthropic’s Claude models through GCP Vertex and AWS Bedrock (depending on the deployment region).
Data processed
Data processed may include the following, based on customer input:
Target and scope configuration: target URLs, customer domains/subdomains, and free-text assessment guidance
Authentication credentials: provided by the customer to enable authenticated testing, including cookies, HTTP authentication, and JWT/OIDC tokens
Application and API traffic: HTTP request/response pairs as exploit "proof"
Network/infrastructure posture: web/API targets
Source code context: black-box testing is performed by default. Based on relevant product configurations, source code context from Snyk Code may be processed to support gray-box testing
Generated findings and reports: identified vulnerabilities, Python PoC exploit code, LLM reasoning traces, and CVSS scores.
Additional information
More information about Continuous Offensive Security is available here.
Additional AI safeguards and controls
Snyk has taken a proactive approach to AI governance by implementing robust policies, procedures, and technical controls to encompass AI-specific considerations. In addition to Snyk's internal policies and controls, we maintain an overarching AI Governance Program managed by our cross-functional AI Advisory Board.
Snyk's AI capabilities are specifically designed to support the same functionality as our underlying platform: identifying vulnerabilities in code, proposing fixes to those vulnerabilities, and promoting security within the software development lifecycle. Our AI governance incorporates key principles of emerging AI regulations. This includes validating our deterministic training datasets for quality and copyright compliance, and ongoing testing of output quality. Snyk's AI capabilities are designed to enable our customers to assess AI-related risks and vulnerabilities, including governance mechanisms, transparency measures, and security controls.
How Snyk handles data generally
View How Snyk handles your data for more general information about Snyk's data management practices.
Last updated
Was this helpful?