Snyk tackles AI security; Relyance takes on compliance

Welcome to Runtime! Today on Product Saturday: Snyk introduces an API security tool, Relyance follows your data on its journey, and the quote of the week.

(Was this email forwarded to you? Sign up here to get Runtime each week.)

Ship it

DASTy: The rush to ship generative AI applications has almost certainly created a whole new attack surface for adversaries to exploit, in much the same way that security tactics needed a refresh after the shift to cloud computing. Snyk acquired Probely last year to add its dynamic application security testing (DAST) technology to its security platform, and this week launched its first product to incorporate that tech.

Snyk API & Web was designed to help "teams to proactively discover, inventory and secure API vulnerabilities before they become threats," the company said in a blog post. APIs have long been a weak point in cybersecurity, and generative AI apps that use multiple APIs to connect data and models have introduced a new level of complexity.

Speedy delivery: Harness also made a recent acquisition focused on API security, snapping up Traceable, which was part of CEO Jyoti Bansal's startup incubator, in February. And this week it also launched its first product since that deal closed called Traceable Cloud Web Application and API Protection (WAAP), which was designed to bring API security services into Harness's CI/CD software to detect problems before apps reach production.

The new service "delivers deep, context-aware protection for web applications and APIs—helping you detect threats earlier, respond faster, and enforce consistent, intelligent defenses across your entire stack," Harness said in a blog post. It also allows companies to defend themselves against DDoS attacks and malicious bots.

Rules of the road: While it's hard to imagine the U.S. imposing new data regulations over the next, let's say, 1,364 days, any company that operates around the world is subject to all kinds of rules specifying how they use and store data. That means they have to show those governments evidence that they are protecting user data, and Relyance introduced a new platform this week that was designed to help them keep track of everything.

The Relyance AI Data Journeys service provides "a panoramic view of the entire data ecosystem—mapping intricate interactions between services, applications, infrastructures, and processes, without the professional services implementation requirements that legacy data governance solutions demand," the company said in a press release. “You can really get at the heart of the 'why' of data processing, which is the most foundational layer needed for general AI governance,” CEO Abhi Sharma told VentureBeat, referring to the fact that data is often transformed as it is used for different purposes.

Mind the store: One open question about the evolution of enterprise AI has been whether more companies will consider keeping their data on-premises, given its strategic value and the cost of transferring data back and forth to the cloud. Lenovo would love to see that trend emerge, and this week it announced an overhaul of its storage products with AI in mind.

In all, the company announced 21 new storage products and services designed to help companies that want to keep a tighter rein on their data. "If you want to modernize, to improve your virtualization, to be ready for AI you really need to move to flash and that’s a big transformation for customers," Lenovo's Stuart McRae told CRN, noting that a lot of companies are still storing data on traditional disk drives.

IDs for machines: If agentic AI is going to thrive, companies need easier ways to make sure that agents contacting their networks are properly identified and validated, because you can't send agents a one-time text code. MCP could be one part of that solution, but authentication software is a crucial piece of that puzzle.

Descope launched its Agentic Identity Hub this week, which was designed to "solve authentication and authorization challenges for AI agents, systems, and workflows," the company said in a press release. The idea is to give developers an easier way to incorporate standards like MCP and OAuth into their apps, and Descope's platform allows them to build entire identity-management systems without having to write code.

Stat of the week

Microsoft released its annual Work Trends report this week, which combined surveys and user behavior on Microsoft 365 services to paint a picture of today's enterprise. Get ready to become what Microsoft called an "agent boss," which sounds fun: "leaders expect their teams will be training (41%) and managing (36%) agents within five years."

Quote of the week

"Predicting the next few quarters is essentially playing darts blindfolded." — Wedbush Securities analysts, as noted by Quartz, describing the uncertainty that has engulfed the business world thanks to the volatile and fantastical economic policies brewing in Washington, D.C.

The Runtime roundup

Synadia CEO Derek Collison responded to the CNCF's statement about the future of NATS with a vague yet carefully worded blog post that completely ignored the CNCF's central claim that Synadia refused to transfer the NATS trademark following the 2018 agreement between the two organizations to accept NATS as an incubating project.

"Jim Cramer explains why he’s still optimistic on data center buildout," CNBC said Thursday, which means the data center boom is over.

Thanks for reading — see you Tuesday!