---
title: "Project Glasswing Explained: Origins, Process, and Cyber Defense Results"
date: "2026-10-18T12:59:18+00:00"
url: "https://checkmarx.com/learn/appsec-vendors/claude-mythos/project-glasswing-explained-origins-process-and-cyber-defense-results/"
description: "Project Glasswing is an initiative launched by Anthropic on April 7, 2026, to secure critical global software infrastructure using defensive AI capabilities. The program was created shortly after the release of Claude Mythos Preview, a frontier model that demonstrated a significant increase in autonomous vulnerability discovery and exploit development."
---

# Project Glasswing Explained: Origins, Process, and Cyber Defense Results

## Summary

Project Glasswing is an initiative launched by Anthropic on April 7, 2026, to secure critical global software infrastructure using defensive AI capabilities. The program was created shortly after the release of Claude Mythos Preview, a frontier model that demonstrated a significant increase in autonomous vulnerability discovery and exploit development.

## What is Project Glasswing?

Project Glasswing is an initiative launched by Anthropic on April 7, 2026, to secure critical global software infrastructure using defensive AI capabilities. The program was created shortly after the release of Claude Mythos Preview, a frontier model that demonstrated a significant increase in autonomous vulnerability discovery and exploit development compared with previous Claude models.

Anthropic subsequently expanded Glasswing beyond its roughly 50 initial participants, adding approximately 150 organizations in more than 15 countries. The broader objective is not simply to discover more vulnerabilities but to help the security industry adapt its disclosure, prioritization, remediation, and patch-deployment processes to an environment where AI can find security weaknesses at much greater speed and scale.

**How project Glasswing works:**

- **Partner access, usage credits, and model pricing:** Vetted organizations receive restricted Mythos access, supported by up to $100 million in usage credits.
- **Scope of work: securing first-party code and open-source dependencies:** Participants examine proprietary software and shared dependencies to discover vulnerabilities, validate exploitability, and develop patches.
- **Coordinated vulnerability disclosure:** Anthropic validates findings and coordinates disclosure with maintainers, generally publishing details after 90 days or when a patch becomes available, whichever comes first.
- **Anthropic funding for open-source security:** Anthropic committed $2.5 million to Alpha-Omega and OpenSSF through the Linux Foundation and $1.5 million to Apache.

**Key launch partners:  
The initiative brings together major technology, hardware, cloud, and finance leaders, including:

- Amazon Web Services (AWS)
- Microsoft
- Google
- Apple
- Broadcom
- Cisco
- NVIDIA
- Checkmarx
- Palo Alto Networks
- CrowdStrike
- JPMorgan Chase
- Linux Foundation

**Results from project glasswing:**

- **Over 10,000 high- and critical-severity vulnerabilities found by partners:** Anthropic reported that initial partners identified more than 10,000 high- or critical-severity findings by May 2026, although not all were independently confirmed as exploitable.
- **Open-source scanning results and true-positive rates:** Independent reviewers confirmed 90.6% of 1,752 reviewed findings as genuine vulnerabilities; 62.4% were confirmed as high or critical severity.

This is part of a series of articles about [Claude Mythos](https://checkmarx.com/learn/appsec-vendors/claude-mythos/claude-mythos-key-capabilities-and-what-it-means-for-cybersecurity/)

## Origins of Anthropic’s Project Glasswing

Anthropic created Project Glasswing after internal testing showed that Claude Mythos Preview had crossed an important cybersecurity capability threshold. The model could autonomously inspect complex software, discover previously unknown vulnerabilities, and combine individual exploitation techniques into complete attack chains. Anthropic concluded that these capabilities could benefit defenders but could also lower the barrier to sophisticated offensive security operations.

### How Frontier AI Lowered the Cost of Finding and Exploiting Vulnerabilities

Traditional vulnerability research can require experienced security researchers to spend substantial time understanding unfamiliar code, identifying suspicious behavior, constructing test cases, debugging crashes, and determining whether a weakness can actually be exploited. Frontier AI can automate much of this iterative work and execute it repeatedly across large codebases.

Mythos Preview demonstrated that an agent could be given a software repository and relatively high-level instructions and then independently inspect source code, execute programs, use debugging tools, form hypotheses, test potential weaknesses, and create proof-of-concept exploits. Anthropic reported that **the model discovered zero-day vulnerabilities** across major operating systems, browsers, and other widely used software.

The significance is not only that AI can identify more vulnerabilities. Mythos also showed a substantial improvement in converting vulnerabilities into usable exploit primitives and **combining those primitives into complete exploit chains**. Anthropic described this exploit-development capability as one of the primary reasons it chose a restricted release rather than making Mythos Preview generally available.

### Why Anthropic Withheld Claude Mythos from General Release

Anthropic withheld Claude Mythos Preview from general release because its cybersecurity capabilities could be used for both defensive and offensive purposes. Although the model could help developers find and fix vulnerabilities, the same capabilities could allow malicious users to discover zero-days, construct exploits, and automate portions of complex cyberattacks.

Anthropic stated that neither it nor, to its knowledge, other AI developers had safeguards sufficiently strong and precise to make unrestricted Mythos-class cybersecurity capabilities broadly available without unacceptable misuse risk. Cybersecurity presents a particularly difficult safety problem because many legitimate defensive activities (such as exploit development, penetration testing, and vulnerability research) closely resemble malicious activity.

Instead, Anthropic released Mythos Preview through Project Glasswing as a gated research model. Participating organizations were vetted, access was subject to restrictions, and the model was intended for [defensive cybersecurity](https://checkmarx.com/learn/ai-security/ai-cybersecurity-6-solutions-transforming-appsec-and-the-soc/) work. Anthropic also deployed monitoring and classifier-based safeguards intended to reduce misuse while allowing trusted security researchers to perform advanced defensive tasks.

## Claude Mythos: The Model Behind Project Glasswing

Claude Mythos is the frontier-model family at the center of Project Glasswing. Anthropic launched the initiative with **Claude Mythos Preview** on April 7, 2026, after internal testing showed that the model could autonomously find, reproduce, and exploit vulnerabilities at a level substantially beyond earlier Claude models. Although Mythos Preview was a general-purpose model rather than a dedicated cybersecurity system, its advanced coding and agentic reasoning made vulnerability research one of its strongest capabilities.

Anthropic replaced Mythos Preview with **Claude Mythos 5** in June 2026, redefining it as a dedicated cybersecurity model. Mythos 5 uses the same underlying model as **Claude Fable 5**, but Mythos provides trusted users with fewer cybersecurity restrictions so they can perform advanced defensive tasks such as vulnerability research and exploit validation. The model was initially offered to existing Project Glasswing participants and other vetted organizations.

With the release of Claude Mythos 5.1 in September, 2026, Anthropic continued the same pattern, releasing Mythos 5.1 and Fable 5.1 as different versions of the same underlying model with different safeguards. Mythos 5.1 remains restricted through Anthropic’s trusted-access programs rather than being generally available, preserving advanced cybersecurity capabilities for vetted defenders and researchers while the more safeguarded Fable model serves general users.

## Project Glasswing Timeline: From the April 2026 Launch to Mythos 5.1

- **April 7, 2026:** Anthropic launches Project Glasswing with Claude Mythos Preview. Approximately 50 organizations receive early access, and Anthropic commits up to $100 million in usage credits plus $4 million for open-source security organizations.
- **May 22, 2026:** Anthropic publishes its first major Glasswing update. Anthropic and approximately 50 partners have identified more than 10,000 high- or critical-severity vulnerabilities, leading the company to conclude that verification, disclosure, and patching are becoming larger bottlenecks than vulnerability discovery itself.
- **June 2, 2026:** Anthropic announces an expansion to approximately 150 additional organizations across more than 15 countries, with greater representation from power, water, healthcare, communications, hardware, and other critical-infrastructure sectors.
- **June 9, 2026:** Anthropic releases Claude Mythos 5 as the successor to Mythos Preview. Existing Glasswing users can upgrade, and pricing falls from 25/125 to 10/50 per million input/output tokens.
- **June 12, 2026:** Anthropic suspends Mythos 5 and Fable 5 after the U.S. government imposes export-control restrictions preventing foreign nationals from accessing the models.
- **July 1, 2026:** Access is restored after the export controls are lifted. Anthropic initially restores Mythos 5 to a set of U.S. organizations approved by the government while continuing discussions about restoring access for the broader domestic and international Glasswing membership.
- **August 2026:** The Apache Software Foundation uses Mythos 5 through Glasswing to scan 230 repositories, illustrating how the program is moving from experimental vulnerability research toward repeatable security processes for large open-source ecosystems.
- **September 1, 2026:** Anthropic introduces Claude Mythos 5.1. The new model improves on Mythos 5 in cybersecurity and other research areas but remains limited to a small group of vetted organizations through Anthropic’s trusted-access programs.

## How Project Glasswing Works

### Partner Access, Usage Credits, and Model Pricing

Project Glasswing began with approximately 50 organizations. Its named launch partners included AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, while Anthropic provided Mythos Preview access to more than 40 additional organizations that built or maintained important software infrastructure. [Checkmarx joined](https://checkmarx.com/press-releases/checkmarx-joins-anthropics-project-glasswing/) Project Glasswing in September 2026.

Anthropic committed up to $100 million in Mythos Preview usage credits to Project Glasswing and additional participants during the research-preview period. Once those credits were exhausted or the covered period ended, participants paid for Mythos Preview tokens at an initial cost of $25 per million input tokens and $125 per million output tokens. Participants could access it through the Claude API, Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry.

Anthropic expanded Project Glasswing on June 2 to approximately 150 additional organizations across more than 15 countries. New participants were required to meet Anthropic’s security requirements before receiving access, with the expansion prioritizing organizations responsible for critical infrastructure and widely depended-on software.

When Mythos 5 replaced Mythos Preview on June 9, Mythos Preview users, including Project Glasswing partners, were upgraded to the new version, and Anthropic reduced the model’s cost to $10 per million input tokens and $50 per million output tokens. For access and pricing of subsequent releases, see the official Mythos [product page](https://anthropic.com/claude/mythos).

### Scope of Work: Securing First-Party Code and Open-Source Dependencies

Glasswing participants use Mythos to examine both software they develop themselves and open-source components on which their products and infrastructure depend. Anthropic identified activities such as local vulnerability detection, black-box binary testing, endpoint security analysis, penetration testing, vulnerability reproduction, and patch development as intended areas of work.

First-party scanning allows companies to apply Mythos to codebases that may never be publicly visible. This can uncover weaknesses before products are released or before vulnerabilities are discovered externally. Partners can also combine Mythos with internal context, threat models, telemetry, and security tools to determine whether a finding represents a realistic attack path.

Open-source security is a second major part of the program because the same packages can appear in thousands or millions of downstream applications. By May 2026, Anthropic had used Mythos Preview to scan more than 1,000 open-source projects. The model initially identified 23,019 potential vulnerabilities, including 6,202 that it rated high or critical. Independent security researchers subsequently reviewed a subset of these findings, demonstrating why human validation remains an important part of the Glasswing workflow.

### Coordinated Vulnerability Disclosure and the 90-Day Window

Finding vulnerabilities at AI scale creates a disclosure problem: immediately publishing thousands of previously unknown security flaws could give attackers detailed information before maintainers have time to create patches. Project Glasswing therefore combines automated discovery with human validation and coordinated vulnerability disclosure.

For vulnerabilities Anthropic discovers itself in open-source projects, or in closed-source software where it has authorization to conduct security research, Anthropic follows a coordinated disclosure policy based on the industry’s standard 90-day disclosure window. Anthropic aims to notify the affected vendor or maintainer as soon as possible and, unless there is a compelling security reason to do otherwise, make vulnerability information available to defenders after 90 days or once a patch is released, whichever occurs first.

Anthropic also says it attempts to provide human-reviewed reports and suggested fixes where practical. Importantly, it does not simply send maintainers every raw model finding. Reports are triaged and validated, and Anthropic says it tries to pace submissions according to what individual projects can realistically process.

### Anthropic Funding for Open-Source Security: Alpha-Omega, OpenSSF, and the Apache Software Foundation

Anthropic paired access to Mythos with direct financial support for organizations responsible for open-source security. At Glasswing’s launch, the company announced $4 million in donations to open-source security organizations in addition to the $100 million commitment in model credits.

Of this funding, $2.5 million went to Alpha-Omega and the Open Source Security Foundation (OpenSSF) through the Linux Foundation. Anthropic subsequently established a partnership with OpenSSF’s Alpha-Omega project to help open-source maintainers process and triage the increased volume of vulnerability reports produced by AI-assisted scanning.

The remaining $1.5 million was donated to the Apache Software Foundation (ASF). Apache said the funding would support infrastructure, security, and the communities responsible for its widely used open-source projects.

## Key Companies Participating in Project Glasswing

Project Glasswing brings together technology companies, cybersecurity providers, financial institutions, and open-source organizations to evaluate frontier AI for defensive cybersecurity. Participants use Mythos models to discover and validate vulnerabilities, improve remediation workflows, and assess the implications of increasingly capable AI tools.

As of the time of this writing, these are some of the key organizations participating in the project and receiving access to the Claude Mythos model:

**Cloud providers**

- **Amazon Web Services**: A launch partner providing approved access to Mythos Preview through Amazon Bedrock. AWS also tested the model against critical internal codebases, reporting additional security improvements with less manual guidance.
- **Microsoft**: Provided early access to its Security Response Center for vulnerability discovery and response. It also evaluated Mythos using its CTI-REALM benchmark and offered approved customer access through Microsoft Foundry.
- **Google**: Supported approved access through Google Cloud and contributed experience from AI-assisted vulnerability research initiatives such as Big Sleep and CodeMender. It emphasized giving defenders advanced AI capabilities before attackers gain comparable access.

**Cybersecurity vendors**

- **Checkmarx**: Announced participation on September 3, 2026, using Claude Mythos 5 to strengthen vulnerability-detection research and secure its own systems. It is studying discovery, triage, and remediation workflows and plans to share findings with the security community.
- **CrowdStrike**: A founding participant evaluating Mythos’s security implications alongside its threat intelligence and enterprise telemetry. It emphasized protecting the environments where AI agents execute as both defensive and offensive capabilities grow.
- **Palo Alto Networks**: Tested Mythos Preview before Glasswing’s public launch, identifying complex weaknesses missed by earlier models. It later expanded testing across more than 130 products using several frontier models and released patches for relevant initial findings.

**Infrastructure vendors**

- **Cisco**: Joined as a launch partner and used frontier models to stress-test hardware and software for vulnerabilities. Its work also includes adapting disclosure practices and developing tools for AI-assisted security evaluation.
- **Broadcom**: Participated as a trusted model-evaluation partner under a non-disclosure agreement. Its Infrastructure Software Group is integrating frontier AI into [vulnerability management](https://checkmarx.com/learn/vulnerability-management/what-is-vulnerability-management/) for internal environments and customer products.
- **NVIDIA**: Confirmed as a launch partner, with limited public detail about its individual testing. Its inclusion reflects the program’s focus on organizations whose hardware and infrastructure underpin the broader technology ecosystem.

**Organizations with high impact products**

- **Apple**: Confirmed as a launch partner, although public information about its individual Mythos testing remains limited. Its participation reflects Glasswing’s focus on widely deployed hardware, operating systems, and software platforms.
- **JPMorganChase**: Participated to independently evaluate next-generation AI for defensive cybersecurity and financial-infrastructure resilience. The bank emphasized assessing the technology on its own terms while collaborating with other critical-infrastructure organizations.
- **Cloudflare**: Joined after the initial launch and tested Mythos across more than 50 repositories, identifying approximately 2,000 bugs, according to Anthropic. It developed a multi-stage agent harness to validate findings, reduce noise, and assess exploitability.

## Results from Project Glasswing

### Over 10,000 High- and Critical-Severity Vulnerabilities Found by Partners

By May 22, 2026, Anthropic reported that approximately 50 initial Project Glasswing partners had collectively identified more than 10,000 high- or critical-severity vulnerabilities using Claude Mythos Preview. Most participating organizations found hundreds of serious issues, and several reported that their vulnerability-discovery rates increased by more than tenfold.

Cloudflare provides one of the clearest published examples. During early Glasswing testing, it identified approximately 2,000 bugs across critical systems, including around 400 initially categorized as high or critical severity. However, these numbers represent model-generated and triaged findings rather than proof that every issue was independently confirmed as exploitable.

### Open-Source Scanning Results and True-Positive Rates

Anthropic separately used Mythos Preview to scan more than 1,000 open-source projects, generating 23,019 candidate vulnerabilities, including 6,202 initially rated high or critical.

Independent security firms manually reviewed 1,752 of those higher-severity findings and confirmed that:

- **90.6% of vulnerabilities** (1,587) were real vulnerabilities.
- **62.4% of vulnerabilities** 1,094) were confirmed as high or critical severity.

The difference between those percentages is important. A true positive means that a genuine bug existed, but it does not necessarily mean the issue was as severe as Claude initially predicted, was reachable in a normal deployment, or posed an immediate exploitation risk. Human validation remained necessary to determine real-world impact and priority.

Anthropic’s later disclosure dashboard showed the program continuing to scale. As of August 26, 2026, Claude models had generated 26,153 candidate findings, with 5,008 reviewed externally and 4,576 confirmed as valid, representing a **91.4% true-positive rate**. Anthropic had disclosed 2,300 vulnerabilities across 392 open-source projects and was aware of 421 upstream patches.

## The Role of Application Security Platforms in the Mythos Era

Frontier models such as Claude Mythos are changing the economics of vulnerability discovery. They can uncover previously unknown weaknesses and accelerate exploit development, but AI-based analysis can also produce inconsistent results, miss vulnerabilities, or lack the application and deployment context needed to determine actual risk.

As vulnerability discovery becomes faster, organizations increasingly need application security platforms that can turn a much larger volume of findings into reliable, actionable security decisions.

### Combine Probabilistic AI With Deterministic Security Analysis

AI models can reason about unfamiliar code and identify vulnerability patterns that traditional scanners may not detect. However, probabilistic model output should be combined with deterministic security analysis that provides repeatability, policy enforcement, auditability, and application-specific context. This hybrid approach can improve coverage of both known and previously unknown vulnerabilities while reducing the risk of relying entirely on inconsistent model-generated findings.

### Validate and Prioritize AI-Discovered Vulnerabilities

Finding vulnerabilities is only the first step. Application security platforms need to determine whether findings are genuine, understand their exploitability and surrounding context, remove duplicate or low-value results, and identify which issues create the greatest real-world risk. This becomes especially important as frontier AI dramatically increases the number and speed of potential vulnerability discoveries.

![percentage of developers applying appsec best practices](https://checkmarx.com/wp-content/uploads/2026/10/image-118.png)

 Checkmarx’s own [research](https://checkmarx.com/foa-report/) found the same validation gap industry-wide: *“While 96% of developers have AI security tooling in their IDEs, and virtually all (99.6%) rate it effective, only 18% apply security continuously as code is written. The tools do the work, but organizations lack in translating this into process.*

### Automate Vulnerability Triage and Remediation

Manual triage cannot easily scale when AI systems can generate large volumes of vulnerability findings across thousands of repositories. Agentic security capabilities can help investigate findings, enrich them with context, prioritize exploitable risks, recommend fixes, and accelerate [remediation workflows](https://checkmarx.com/learn/aspm/vulnerability-remediation-process-best-practices-tools/). Automation allows security teams to focus human attention on complex or high-impact issues rather than processing every finding individually.

### Shift Security Earlier in the Development Lifecycle

As AI-assisted development increases the speed at which software is produced, vulnerabilities should be identified as close to code creation as possible. Integrating application security into developer workflows, repositories, pull requests, and CI/CD pipelines allows teams to address weaknesses before they reach production. In the Mythos era, this prevention-oriented approach becomes increasingly important because attackers may be able to discover and weaponize vulnerabilities much faster than traditional remediation cycles can respond.

This mirrors a broader pattern Checkmarx has documented: *“Tool sprawl is the #1 AppSec challenge (37%)… The tools work, but organizations don’t know how to translate their output into effective decisions.*

[vimeo Video Player](https://vimeo.com/1215243020/b8faf3a510)

 [ ![Triage and Remediation Pilot Program Video Thumbnail walkthrough](https://checkmarx.com/wp-content/uploads/2026/10/Triage-and-Remediation-Pilot-Program-Video-Thumbnail-2-1.png) ](#)

Glasswing-Era AppSec

### Resolve Risk as Fast as AI Delivers It

Turn scan results into prioritized decisions and review-ready fixes without manual triage or workflow disruption.  
Watch the power walkthrough

 [Explore the Solution](https://checkmarx.com/product/triage-and-remediation/)

## Best Practices for Application Security Teams Preparing for Mythos-Class Threats

### Scan Both Human-Written and AI-Generated Code Continuously

Apply the same application security controls to code regardless of whether it was written manually or produced with an AI coding assistant. AI-generated code can contain insecure patterns, vulnerable dependencies, or configuration mistakes, and increased development velocity can cause these issues to enter repositories much faster.

Run security testing continuously as developers commit code, update dependencies, and modify configurations. Integrating scanning throughout the development lifecycle helps organizations detect newly introduced vulnerabilities quickly rather than relying on periodic assessments that may allow insecure code to remain unnoticed for long periods.

### Detect Vulnerabilities as Early as Possible in Developer Workflows

Move security testing closer to the point where code is created so vulnerabilities can be identified before they reach later development stages. Security checks can be integrated into IDEs, source-control systems, pull requests, and CI/CD pipelines to provide developers with feedback while they are actively working on the affected code.

Early detection also reduces the cost and complexity of remediation. Developers are more likely to understand the surrounding code when an issue is reported immediately, while security teams can prevent vulnerable code from progressing further through the pipeline instead of discovering it after deployment.

### Centralize Application Risk Visibility Across the SDLC

Create a centralized view of vulnerabilities and application risk across repositories, development teams, applications, and deployment environments. Organizations commonly use multiple security testing tools, which can produce fragmented findings that make it difficult to understand the overall security posture of an application.

Centralized visibility allows teams to correlate findings from different testing methods, identify duplicate issues, monitor remediation progress, and apply consistent security policies across the organization. It also helps security leaders understand which applications and vulnerabilities represent the greatest risk rather than reviewing findings from individual scanners in isolation.

### Validate Vulnerability Reachability and Exploitability Before Prioritizing

Avoid prioritizing vulnerabilities based solely on severity scores or the initial assessment of an AI model or scanner. A vulnerability may technically exist but still present limited practical risk if the affected code is unreachable, the vulnerable function is never executed, or environmental controls prevent exploitation.

Enrich vulnerability findings with application, dependency, deployment, and runtime context to determine whether an attacker could realistically exploit them. This enables teams to focus remediation on vulnerabilities that create meaningful attack paths while deprioritizing findings that have little or no impact in the application’s actual operating environment.

### Use AI-Assisted Remediation With Developer Review

Use AI-assisted remediation to help developers understand vulnerabilities and generate potential fixes directly within their development workflows. AI can analyze vulnerable code, suggest safer alternatives, and provide contextual remediation guidance, reducing the time between identifying a vulnerability and producing a possible fix.

Developers should still review proposed changes before they are merged or deployed. AI-generated fixes may affect application functionality, introduce unintended behavior, or fail to address the root cause completely, so remediation should be validated through code review, testing, and security rescanning to confirm that the vulnerability has actually been resolved.

## **Preparing for Mythos-Class Discovery with Checkmarx**

Project Glasswing’s own results make the underlying problem concrete: AI found 23,019 candidate vulnerabilities in open-source code alone, but only after independent human reviewers validated them did the program know which 90.6% were real and which 62.4% actually mattered. That validation step, separating genuine, exploitable risk from AI-generated noise — is exactly what application security platforms need to do at enterprise scale, continuously, not as a one-time research exercise.

Checkmarx Fusion applies the same principle Glasswing demonstrated: pairing frontier AI’s detection reach with deterministic validation before a finding ever reaches a developer.

**Key capabilities of Checkmarx Fusion SAST and Triage & Remediation Assist:**

- **Hybrid deterministic and AI detection:** Depending on the language, a rules-based or AI-based engine runs first, and several curated frontier AI models are layered on top. Each model approaches the code differently, surfacing logic-based flaws and vulnerabilities with no known rule or prior CVE, including in AI-generated code and in languages that rules-based tools do not cover.
- **High-fidelity results with fewer false positives:** The Findings Analysis Engine removes false positives and deduplicates findings into one clean output. Checkmarx reports an F1 score of 0.74 for Fusion in SAST, compared with 0.64 for Next-Gen SAST and roughly 0.20 for query-based SAST, with 60–70% fewer false positives than standalone AI scanning.
- **Consistent results at a predictable cost:** Fusion runs a bounded, curated set of Checkmarx-validated models rather than open-ended frontier API calls, so repeated scans return the same answer. Teams can choose higher- or lower-cost models according to their needs, avoiding token bills that compound across every commit.
- **Portfolio-scale scanning:** Fusion can scan an entire project portfolio in a single operation, with results organized by project and comparable across codebases. Incremental scanning re-scans only new and changed code, so scans get faster over time.
- **Attackability-based triage:** Triage Assist classifies eligible SAST and SCA findings as False Positive, Acceptable Risk, or Action Required based on reachability, exploitability, policy, and code context. Automated triage rules keep the backlog current so teams focus on the issues that materially reduce exposure.
- **Review-ready remediation:** Remediation Assist turns prioritized risks into remediation guidance in Checkmarx One. For supported GitHub projects, it surfaces AI triage verdicts in pull requests and generates fix PRs for review. Nothing merges automatically, and developers stay accountable for final changes.
- **Unified risk view and measurable impact:** Fusion findings are scored and prioritized in Checkmarx One alongside every other signal in the portfolio. AI Assist Usage Analytics tracks adoption, developer time saved, and remediation activity. Checkmarx reports up to 95% faster MTTR and 65%+ of findings fixed on the first attempt.
- **Expanding scan coverage:** SAST is available now in Fusion, with Secrets Detection, IaC, API Security, and DAST being added on the same architecture. Fusion runs in CI/CD and pull request workflows on Checkmarx One.

Learn more about [Checkmarx Fusion](https://checkmarx.com/platform/checkmarx-fusion/) and [Checkmarx Triage & Remediation Assist](https://checkmarx.com/product/triage-and-remediation/).