Legit Security extends agentic remediation to open-source dependencies
Legit Security has expanded its Agentic Remediation capability to cover vulnerabilities in open-source dependencies, moving the tool beyond its original scope of first-party code. The Tel Aviv-based application security vendor says the update allows development teams to go from vulnerability detection to a verified, ready-to-merge pull request without manual backlog triage.
The announcement reflects a structural problem that has become acute as AI-assisted coding accelerates software delivery. Modern codebases draw heavily on third-party packages, and a vulnerable transitive dependency buried several layers deep in the supply chain can be harder to triage than a bug in code the team wrote themselves. Legit's argument is that agentic automation can close that gap where human-paced workflows cannot.
How the agent works
When the agent identifies a vulnerable dependency, it determines whether the affected package is a direct or transitive dependency, then selects the smallest version bump that resolves the issue while staying within the current major version to minimise the risk of breaking changes. It updates the dependency manifest, regenerates the lockfile, and re-scans the result before opening a pull request. The PR itself carries the vulnerability details alongside confirmation that the fix has been verified.
Where a resolution requires crossing a major version boundary, the agent adds an AI-assessed layer that analyses how the specific repository uses the affected package and proposes the code adaptations needed. Legit is explicit that this step is AI-assessed rather than independently verified through re-scanning, and says the pull request flags the distinction clearly so developers know which parts of the change warrant closer review before merging.
Market context
Dependency vulnerability management sits at a crowded intersection of software composition analysis (SCA) and application security posture management (ASPM). Established SCA vendors including Snyk, Mend (formerly WhiteSource) and the GitHub-native Dependabot already surface vulnerable package versions and can automate version-bump pull requests. Legit's differentiation is the verification loop: re-scanning after the fix is applied before a PR is opened, rather than leaving the developer to confirm correctness.
The broader ASPM category, in which Legit competes, is consolidating. Several larger security platforms have acquired or built SCA capabilities in the past two years, and the pressure on standalone AppSec vendors to demonstrate automation depth is increasing. Agentic approaches that reduce mean-time-to-remediation are emerging as a key battleground, particularly as enterprise security teams face alert volumes they cannot clear manually.
Regulatory and standards read-across
Supply-chain security has attracted regulatory attention on both sides of the Atlantic. In the United States, the executive order on improving national cybersecurity (EO 14028) and the subsequent CISA guidance on software bill of materials have pushed organisations to maintain accurate dependency inventories. In Europe, the Cyber Resilience Act, which passed in 2024 and begins phasing in obligations from 2027, imposes security-by-design requirements on software sold into the EU market, explicitly including vulnerability management across the software supply chain.
Legit did not disclose customer numbers, the volume of pull requests opened by the agent in production, or how the capability is priced relative to its existing platform. The company also did not name a named enterprise customer using the dependency remediation feature. Buyers evaluating the tool will want to see benchmarked data on false-positive rates and the proportion of fixes that pass code review without further modification, particularly for the AI-assessed major-version upgrade path.