Harness ships security agents spanning vulnerability scans, fixes and virtual patches

Harness launched a package of AI-assisted security tools on August 19th that integrates vulnerability scanning, triage, remediation, and virtual patching into its software delivery pipelines, following its March 2025 merger with Traceable. The six capabilities—AI SAST, LLM Scan Orchestration, Triage Agent, Remediation Agent, Zero-Day Agent, and virtual patching—are available on the Harness platform, though the company has not released public customer results to substantiate its claims of faster remediation and fewer false positives.

Harness ships security agents spanning vulnerability scans, fixes and virtual patches Jyoti Bansal is folding scanning, triage, remediation and production protection into the delivery pipeline after Harness merged with Traceable. By RuntimeWire Staff /author/runtimewire-staff · Published Primary source: PR Newswire https://www.prnewswire.com/news-releases/harness-launches-ai-agents-for-machine-speed-vulnerability-response-302855262.html Why it matters Bansal is trying to make Harness the control plane for both shipping and securing software. The advantage depends on whether its agents produce reliable fixes, not simply more findings. Jyoti Bansal @jyotibansalsf https://x.com/jyotibansalsf?ref=runtimewire 's Harness https://www.harness.io/?ref=runtimewire launched a package of AI-assisted security tools on August 19th https://www.prnewswire.com/news-releases/harness-launches-ai-agents-for-machine-speed-vulnerability-response-302855262.html?ref=runtimewire that moves vulnerability scanning, triage, remediation and temporary production protection into the same pipelines used to ship software. The release is Bansal's clearest attempt yet to turn Harness's March 2025 merger with API security startup Traceable https://www.harness.io/blog/harness-traceable?ref=runtimewire into a product advantage. Harness already controls deployment workflows for its customers. The new security agents are designed to use that position to follow a vulnerability from detection to a proposed code fix, then protect production while a developer reviews the permanent repair. Harness says all six capabilities are available as part of its platform: AI SAST, LLM Scan Orchestration, a Triage Agent, a Remediation Agent, a Zero-Day Agent and virtual patching. Harness has not attached public customer results to the release, so its claims about faster remediation and fewer false positives remain company-supplied performance assertions. Bansal's security merger reaches the pipeline Bansal started Harness in 2017 after selling AppDynamics to Cisco for $3.7 billion https://www.forbes.com/sites/alexkonrad/2017/10/24/appdynamics-founder-jyoti-bansal-launches-big-labs-and-harness/?ref=runtimewire , one day before its planned initial public offering. An IIT Delhi computer science graduate, he had spent years building application-performance software, only to hear from customers that getting code safely into production remained slow and dependent on internal tooling. Harness began with continuous delivery, automating deployments and rollbacks. Bansal later co-founded Traceable with Sanjay Nagaraj to secure the APIs connecting modern applications. The two products approached software risk from opposite ends: Harness knew how code moved toward production, while Traceable observed application and API behavior once systems were running. Harness and Traceable announced a definitive merger agreement on February 10, 2025, and completed the merger effective March 4, 2025 https://www.prnewswire.com/news-releases/harness-and-traceable-complete-merger-creating-worlds-most-advanced-ai-native-devsecops-platform-302392412.html?ref=runtimewire , bringing Traceable's API-security capabilities into Harness. Traceable co-founder Sanjay Nagaraj https://www.theorg.com/org/traceable-ai/org-chart/sanjay-nagaraj?ref=runtimewire joined the combined company as an application-security engineering leader. Rahul Sood https://www.harness.io/authors/rahul-sood?ref=runtimewire , formerly chief product officer at Pindrop and an executive at Palo Alto Networks, Google, Meta and SAP, now leads that portfolio. The August release turns the merger thesis into a workflow. Harness is betting that security findings become more useful when the system identifying them can also see repositories, pipelines, artifacts and deployment controls. That context can help determine whether vulnerable code is reachable, which applications are exposed and where a proposed fix should go. Harness reinforced that strategy with a $240 million Series E https://techcrunch.com/2025/12/11/harness-hits-5-5b-valuation-with-240m-to-automate-ais-after-code-gap/?ref=runtimewire in December 2025 at a $5.5 billion post-money valuation. Goldman Sachs led a $200 million primary investment, while IVP, Menlo Ventures and Bansal's Unusual Ventures participated in a related $40 million employee tender offer. The financing gave Bansal room to keep broadening Harness beyond its original continuous-delivery market. One path from finding to deployment AI SAST pairs deterministic static analysis with an AI layer intended to suppress noisy findings and catch authorization flaws such as insecure direct object references, where an application improperly exposes another user's data or resources. LLM Scan Orchestration lets customers connect their own model-based scanners and feed their results into Harness's existing security workflow. The Triage Agent ranks findings according to exploitability. The Remediation Agent writes and validates a proposed repair, then opens a pull request for a developer to review. The Zero-Day Agent monitors newly disclosed vulnerabilities, maps them against a customer's pipelines and artifacts, and prepares a proposed fix. Virtual patching adds a temporary protection layer without requiring an immediate code change, buying engineers time to complete the permanent repair. Sood said in Harness's announcement https://www.prnewswire.com/news-releases/harness-launches-ai-agents-for-machine-speed-vulnerability-response-302855262.html?ref=runtimewire Harness built the agents to "make security a first-class part of the delivery pipeline itself." Harness says the combined workflow can reduce the distance between discovery and deployment from weeks to hours. That outcome has yet to be established through independent benchmarks, and the release does not identify how many customers are already running the new agents. Human approval remains central to the remediation flow. Harness's own developer documentation https://developer.harness.io/docs/security-testing-orchestration/remediations/ai-based-remediations/?ref=runtimewire warns that an AI-generated suggestion may be invalid, may fail to remediate the vulnerability and could introduce other issues. The Remediation Agent's pull-request model reflects that limitation: Harness automates diagnosis and code generation while leaving the merge decision with an engineer. Customers can request an application-security demo https://www.harness.io/demo/application-security-testing?utm source=harness io&utm medium=cta&utm campaign=ast&ref=runtimewire to learn more. The application-security market already has agents Harness is arriving in a market where security vendors have spent 2026 attaching agents to scanners. Snyk launched Agent Security and Evo AI-SPM https://snyk.io/news/snyk-launches-agent-security-solution/?ref=runtimewire in March 2026, including agents for discovery, risk intelligence and policy enforcement. Snyk also offers Agent Fix, which generates proposed repairs from security findings. Endor Labs introduced AURI https://www.endorlabs.com/learn/introducing-auri-security-intelligence-for-ai-coding-agents-and-developers?ref=runtimewire in March 2026 to put security intelligence inside coding agents and developer tools. Apiiro's Guardian Agent https://apiiro.com/blog/introducing-apiiro-guardian-agent/?ref=runtimewire focuses on stopping insecure or noncompliant code before it enters an application. Harness's distinction is the breadth of the path after detection. Bansal is selling a single system that can scan code, prioritize findings, prepare a fix, open the pull request and control how protection reaches production. The strategy reduces handoffs between security and delivery products, provided Harness's agents can produce fixes engineers trust. The launch also follows Harness's July 21st release of Agent DLC security controls https://www.harness.io/blog/securing-the-agent-dlc?ref=runtimewire , which govern the models, tools, prompts and APIs used by AI agents. Together, the two releases extend Bansal's original software-delivery thesis into security: the valuable layer sits around code, where organizations decide what can move, what must stop and who gets to approve the change. That is the larger bet behind the Traceable merger. Bansal has spent nearly a decade assembling the systems surrounding production software. The new security agents give Harness another reason for customers to keep those systems under one roof, while placing the burden on Harness to prove that machine-generated repairs can survive human review.