Snyk has made Evo Continuous Offensive Security generally available, giving security teams an AI system that autonomously pentests applications and red-teams AI agents on an ongoing basis rather than once or twice a year. The announcement, made August 4, 2026, at Black Hat USA, is real and the product is live — but it arrived bundled with several other pieces of Snyk’s security platform that are not equally finished. Some are available to every customer today. Others are previews still being tested with early users. Understanding which is which matters more than the headline.
Table of Contents
What Snyk Announced
Snyk describes Evo Continuous Offensive Security, or COS, as autonomous, AI-powered pentesting built to keep pace with software that AI tools now help write and ship at a much faster clip than before. The company positioned the general availability announcement as the centerpiece of what it called its broadest platform expansion to date, organized around four activities: discovering an organization’s attack surface, remediating existing vulnerabilities, validating what’s actually exploitable, and preventing new risk from accumulating.
It’s worth being precise about the timeline. Snyk didn’t spring this on the market in August. It first unveiled Evo COS back on May 27, 2026, describing it then as already in use by design partners, including some large financial services and technology firms. What happened at Black Hat in August was the shift from that early-access phase to full general availability — a meaningful milestone, but not the product’s debut.
The August announcement was distributed through Snyk’s own newsroom and syndicated via Business Wire, and it drew coverage from independent security trade outlets including Help Net Security, which confirmed the core details of the release.
How Evo COS Works
Evo COS is built from three components that Snyk says work together as a single continuous program rather than as separate tools.
The first, which Snyk calls AI Pentesting, is meant to do what a skilled human penetration tester does: reason about what an application is actually supposed to do, then look for ways that logic can be subverted. Rather than scanning for known vulnerability patterns, it plans multi-step attacks, chains findings together into a narrative of how an intrusion might unfold, and — according to Snyk — attaches a runnable proof-of-concept to every confirmed vulnerability instead of a bare description.
The second component, Agent Red Teaming, targets a newer problem: applications that now have AI models and autonomous agents embedded directly in them. It simulates a specific attack sequence — a malicious prompt, followed by prompt injection, then abuse of the tools an agent can call, then data exfiltration — designed to catch the kinds of manipulation that a traditional vulnerability scanner has no way to detect.
The third piece, Dynamic Testing, or DAST, handles the more conventional and well-understood vulnerability classes: cross-site scripting, SQL injection, and misconfigurations. Snyk says this component is highly deterministic and reports a 0.08% false-positive rate, though that figure comes from the company itself and hasn’t been independently verified.
Notably, none of these three pieces work in isolation from the rest of Snyk’s platform. COS pulls in findings that already exist from Snyk’s code-scanning, open-source dependency, and API testing tools, plus signals from Snyk’s AI posture-management product. The idea, as Snyk frames it, is to avoid spending expensive AI reasoning cycles rediscovering cheap, already-known bugs, and instead point that reasoning at the harder architectural flaws those other tools can’t see.
Snyk also addresses a structural problem with AI-driven testing: if the same model both finds a vulnerability and certifies that it’s real, it has an obvious conflict of interest. To get around that, the company says every COS finding is checked by a separate validation model before it’s surfaced to a user. Snyk claims this brings the false-positive rate well below the roughly 30% it attributes to “raw AI tools” generally — again, a comparison drawn from the company’s own materials rather than an outside benchmark.
Why It Matters: The Pentesting Gap
The case Snyk is making rests on a specific and often-cited problem in application security. A typical manual penetration test takes about 15 days to run and costs somewhere between $20,000 and $100,000. It also captures a single moment in time. Once the report is delivered, the application keeps changing — new releases ship, new code goes out — while the next scheduled test might be a year away.
Snyk’s shorthand for this is that a standard pentest covers roughly 15 days out of the year, leaving the other 350 untested at the level of business logic and architecture. That figure is a framing device, not a claim about how much of the year Evo COS itself actively runs — it describes the size of the gap between annual testing and continuous software delivery, not a coverage percentage or uptime statistic for the product.
The scanners that do run continuously — static code analysis, dependency checks, basic dynamic testing — are good at finding implementation bugs with known signatures: an injectable input field, an outdated library, a misconfigured setting. What they generally can’t catch are flaws in what an application is designed to allow, such as one customer being able to access another customer’s data by changing an identifier in a request. Those problems don’t look wrong to an automated scanner because the code is doing exactly what it was told to do. Finding them has traditionally required a human who understands the system’s intent.
Snyk’s argument for Evo COS is that a sufficiently capable AI model can now perform a version of that same reasoning process, repeatedly and at a fraction of the cost of a human engagement.
What’s GA and What’s Still Preview
The August 4 announcement covered more than just Evo COS, and the pieces are not all at the same stage of readiness. That distinction is easy to miss in press coverage that treats the whole announcement as a single launch.
| Capability | Role | Status |
|---|---|---|
| Evo Continuous Offensive Security (AI Pentesting + DAST) | Validate | Generally available |
| Agent Red Teaming | Validate (part of COS) | Generally available |
| Snyk Secrets | Prevent | Generally available |
| Enhanced AI Security Posture Management (AI-SPM) | Discover | Available now to existing customers |
| Evo Agentic Application Security — remediation agent | Remediate | Public preview |
| Evo Agentic Application Security — malicious-code detection agent | Remediate | Private preview |
Evo COS itself, including Agent Red Teaming, is fully generally available, as is Snyk Secrets, a separate product for catching hardcoded credentials before they reach production — also announced as reaching GA the same day. The enhanced AI-SPM capabilities, which give visibility into which AI models, agents, and tools an organization is actually running, are rolling out to existing customers rather than being framed as a new public GA release.
The most forward-looking piece of the announcement, Evo Agentic Application Security, is explicitly not ready for general use. Its remediation agent — meant to automatically fix vulnerabilities rather than just flag them — is in public preview. A companion tool built to catch malicious code before it ships is in private preview, meaning it’s available to a limited set of testers rather than the public.
In short: the part of Snyk’s pitch that finds and proves vulnerabilities is live today. The part that would automatically fix them is still being built out.
Availability and Pricing
Snyk has not published a standalone price for Evo COS. The company’s public pricing page lists Free, Team, and Ignite tiers with per-developer monthly or annual costs, but Evo COS appears only as a featured Enterprise-tier solution requiring a sales conversation. Anyone evaluating the product will need to go through Snyk’s sales process to get a quote; there is no self-serve price to compare against competitors.
Independent Reception
Beyond Snyk’s own materials, the announcement was picked up by independent security trade coverage, including Help Net Security, which reported the general availability of both COS and Snyk Secrets consistent with Snyk’s own description.
What’s absent from the record so far is independent, hands-on technical evaluation. No published third-party benchmark or security research has tested Evo COS’s actual detection accuracy, false-positive rate, or performance against real applications. Every performance figure currently available — the 0.08% DAST false-positive rate, the comparison to a 30% rate for other AI tools, benchmark claims from Snyk’s earlier May announcement — originates with Snyk itself.
Limitations and Open Questions
Several practical questions remain unanswered by what Snyk has published so far. The company hasn’t detailed the specific technical prerequisites for running COS against a customer’s environment — what languages or frameworks it supports, how it authenticates against a live application, or whether it can run entirely on-premises versus through Snyk’s cloud platform.
Pricing structure is likewise undisclosed beyond the general “contact sales” model that applies to Snyk’s Enterprise tier as a whole.
And because no independent researcher has yet tested the product directly, buyers currently have no way to check Snyk’s efficacy claims against outside evidence. That doesn’t mean the claims are wrong — it means they’re unverified, which is a different thing.
What to Watch Next
The clearest signal to watch for is whether Evo Agentic Application Security’s preview features — the automated remediation agent and the malicious-code detection tool — move to general availability, and on what timeline. That would complete the loop Snyk is describing: finding vulnerabilities, proving they’re exploitable, and then fixing them automatically, all without a person in between.
The second thing worth watching is whether any independent security research group publishes an evaluation of Evo COS’s actual detection performance. Until that happens, the product’s real-world effectiveness rests on the word of the company that built it.
For now, what can be said with confidence is narrower than the launch headlines suggest: Snyk has shipped a generally available, AI-driven pentesting and agent red-teaming product, integrated with its existing scanning tools, sold through its enterprise sales channel. The rest of the vision it announced alongside that product is still being built.
Frequently Asked Questions
When did Snyk Evo Continuous Offensive Security become generally available? August 4, 2026, announced at Black Hat USA 2026. Snyk had first unveiled the product on May 27, 2026, when it was used by early-access design partners.
What’s included in Snyk Evo Continuous Offensive Security? Three components: AI Pentesting, which reasons about application logic to find architectural and business-logic flaws; Agent Red Teaming, which tests AI agents for prompt injection and related abuse; and Dynamic Testing (DAST), which covers conventional vulnerability classes like SQL injection and cross-site scripting.
Is Snyk Evo Agentic Application Security available yet? Not fully. Its remediation agent, which automatically fixes vulnerabilities, is in public preview. A separate malicious-code detection agent is in private preview, meaning it’s limited to a smaller group of early testers.
How much does Snyk Evo Continuous Offensive Security cost? Snyk hasn’t published a price. It’s positioned as part of the company’s Enterprise tier, which requires contacting Snyk’s sales team for a quote.
How is Evo COS different from a traditional manual pentest? A manual pentest is a scheduled, point-in-time engagement — typically about 15 days a year, costing $20,000 to $100,000 — that captures a snapshot of an application’s security at one moment. Evo COS is designed to run continuously as an application changes, rather than on a fixed annual or quarterly schedule.
Does Evo Continuous Offensive Security replace existing scanners like SAST or DAST? No. Snyk positions it as complementary. COS draws on findings already produced by Snyk’s static code analysis, open-source dependency scanning, and API testing tools, and directs its reasoning toward the architectural and business-logic issues those tools typically miss.
Was Evo Continuous Offensive Security independently tested or verified? Not that has been published. Independent trade outlets have reported on the announcement itself, but no outside security researcher or benchmark organization has published a hands-on evaluation of the product’s detection accuracy or false-positive rate. Performance figures currently available all originate with Snyk.