Insignary Unveils Clarity AIR to Spot Hidden Open‑Source and AI‑Generated Code

Toronto‑based security firm Insignary announced on October 8, 2026 the general availability of Clarity AIR, a scanning solution designed to reveal open‑source components and AI‑generated code that developers have not declared in their software bill of materials.

Clarity AIR operates at the snippet level, dissecting each line of a codebase to compare it against known open‑source libraries and patterns typical of machine‑learning‑driven code generators. When a match is found that is not reflected in the project's declared dependencies, the tool flags the segment for review, giving security and compliance teams a clear view of hidden risk exposure.

The need for such a capability has grown alongside two parallel trends: the explosive adoption of third‑party open‑source packages and the increasing reliance on AI assistants such as Copilot and Claude to write production code. While both practices accelerate development, they also introduce a “blind spot” where untracked code can slip into applications, potentially violating licensing terms or embedding vulnerabilities that escape traditional static analysis tools.

Industry observers note that existing software composition analysis (SCA) products typically focus on declared dependencies, leaving undeclared snippets invisible. By integrating directly with continuous integration pipelines and supporting common CI/CD platforms, Clarity AIR aims to complement existing SCA and static application security testing (SAST) solutions rather than replace them. Early adopters in the financial services and health‑tech sectors have reported that the tool helped surface previously unnoticed GPL‑licensed code and AI‑generated functions that lacked proper attribution.

Insignary says Clarity AIR will be offered as a SaaS subscription with tiered pricing based on code‑base size and scan frequency. The company also hinted at future enhancements, including automated remediation suggestions and expanded language support beyond the initial Java, Python, and JavaScript focus. As organizations continue to grapple with the complexities of modern software supply chains, tools that close the gap between declared and actual code are likely to become a standard component of DevSecOps toolkits.