Lucent Sky AVM version 2609 releases
- Lucent Sky AVM version 2609 MR (build 13.0.6934)
Lucent Sky AVM version 2609 MR
New features in 2609 MR
Pre-analysis and build
-
Mixed-framework analysis
Mixed-framework analysis enables Lucent Sky AVM to scan source code, configuration files, and dependencies from all supported languages and technology stacks in a single analysis run. Languages that share a common runtime, such as C# and VB.NET or Java and Scala, are analyzed together, allowing the analysis engine to perform data and control flow analysis across language boundaries and identify vulnerabilities whose execution paths span multiple languages, just as it does within a single framework. Findings from languages running on different runtimes are also correlated through hybrid analysis to provide a more comprehensive view of security risks across the entire codebase.
While the underlying analysis and remediation results are equivalent to those produced by multiple single-framework scans, mixed-framework analysis offers a unified assessment of application security across all supported technologies. This provides organizations with a holistic view of the security posture of polyglot applications while simplifying scan management and security review workflows.
Source code analysis
-
API discovery
API discovery is a new analysis mode that automatically discovers web API endpoints directly from source code and configuration files. By combining declarative analysis and functional analysis with a dedicated API discovery rule package, Lucent Sky AVM can identify API endpoints without requiring application execution, instrumentation, or network traffic capture. Discovered endpoints are further processed using ML-augmented analysis to reduce false positives, eliminate duplicate findings, and improve endpoint classification accuracy.
Unlike network-based API discovery solutions that depend on runtime activity and observed traffic, API discovery provides visibility into API endpoints that may be inactive, untested, undocumented, or inaccessible during scanning. During a four-month preview program, Lucent Sky AVM identified 181% more API endpoints than network-based solutions while producing zero false positives, helping organizations build a more complete and accurate inventory of their application attack surface. This comprehensive inventory enables security teams to improve API governance, prioritize risk assessments, and reduce blind spots across their application portfolio.
-
Post-quantum cryptography analysis
Post-quantum cryptography (PQC) analysis identifies the use of cryptographic algorithms and libraries that may become vulnerable to attacks enabled by future advances in quantum computing. While these implementations remain secure against the current state of quantum computing, strategies such as "harvest now, decrypt later" may enable adversaries to collect encrypted data today for decryption once sufficiently powerful quantum computers become available. By analyzing how cryptographic APIs are actually used within an application, PQC analysis can identify code paths that rely on quantum-vulnerable algorithms instead of merely reporting the presence of cryptographic libraries. This helps organizations inventory affected applications and cryptographic implementations, assess long-term exposure, prioritize remediation efforts, and develop migration plans for post-quantum cryptographic standards.
-
Expanded generative AI security analysis
Lucent Sky AVM has expanded analysis of generative AI-related artifacts, including prompt files, agent definitions, skill files, and Markdown documents, for potential prompt injection risks. The analysis can also identify third-party components and content sources that contain potential prompt injection techniques designed to influence generative AI behavior.
-
General improvements across the C/C++, C#, ECMAScript, Go, Java, Lua, Objective-C, PHP, Python, Ruby, Rust, Swift, and VB.NET source code analysis engines
Dependency analysis
-
Exposure score and expanded exploitation intelligence
Exposure score is a new risk-based metric that helps organizations prioritize remediation efforts for vulnerable software components and dependencies. The algorithms combine expanded exploitation intelligence from public and proprietary sources with known exploitation activity, predicted likelihood of exploitation within the next 30 days, and the prevalence and reachability of vulnerable components within the organization's applications.
Unlike secure score, which evaluates the overall security posture of an application, exposure score focuses specifically on third-party and open-source components with known vulnerabilities. By combining threat intelligence with application context, including industry-specific risk signals and organizational usage patterns, exposure score helps security teams identify the vulnerable components that present the greatest software supply chain risk to their organization. As a result, vulnerabilities can be prioritized differently depending on the organization's operating environment, even when the underlying software components and vulnerabilities are the same.
-
Support for uv packages for Python applications
Remediation
-
Post-quantum cryptography remediation
Based on PQC analysis findings and Lucent Sky's deterministic remediation algorithms, the remediation engine can generate Guided Fixes that help upgrade application code from classical cryptographic algorithms to suitable post-quantum alternatives. This capability helps organizations accelerate migration to post-quantum cryptographic standards while maintaining visibility and control throughout the migration process. PQC remediation is currently available only to customers participating in the Lucent Sky AVM Preview Program.
-
General improvements in ML-augmented vulnerability remediation and explanations
Administration
-
Service hooks improvements
Service hooks now support more precise scopes, providing greater control over integration workflows and event-driven automation. They can be used to integrate with CI/CD pipelines and external systems, as well as to receive targeted notifications when vulnerable dependencies are newly discovered or when the status of existing dependency vulnerabilities changes.
-
Microsoft Entra ID support for on-premises deployments
Added support for Microsoft Entra ID authentication in on-premises deployments. Organizations can now use Microsoft Entra ID as an alternative to Active Directory for authentication and identity management.
Interfaces
- Support for IntelliJ IDEA 2026.2
Breaking changes in 2609 MR
-
.NET Framework CLI retirement
Potentially breaking change. The .NET Framework CLI has been retired and no binaries will be provided starting version 2609. Users who still use the .NET Framework CLI should migrate to the cross-platform CLI, which is backward-compatible with syntax and commands for the .NET Framework CLI.