Cybersecurity Tech Brief By HackerNoon
Insignary Launches Clarity AIR to Detect Undeclared Open-Source and AI-Written Code
Oct 9, 2026 · 5 min · 7 segments
This story was originally published on HackerNoon at…
Cybersecurity Tech Brief By HackerNoon
Oct 9, 2026 · 5 min · 7 segments
This story was originally published on HackerNoon at…
New snippet-level scanning shows security and compliance leaders which open source code and which AI-written code never made it into a manifest.
Insignary Inc. today announced the general availability of Insignary Clarity Air, a source code scanning product built to answer a question most security teams can't currently answer with confidence: What is actually running in their software beyond what developers reported? Manifests and SBOMs built from declared dependencies are only as complete as what developers chose to report.
An estimated seventy to ninety percent of applications today are built substantially on open source code, and a meaningful share of it arrives through channels no manifest captures: a function copied from another project, a snippet pulled from a forum, a block an AI coding assistant generated and nobody reviewed line by line.
For a CISO signing off on an SBOM or a legal team certifying license compliance, that gap is unmanaged risk sitting inside a document meant to prove the opposite.
Clarity Air is built to close it at the source code level rather than the manifest level.
It finds open source your manifest doesn't know about, matching source code against Insignary's fingerprint database of the open source ecosystem.
Even when the code has been modified, adapted, or regenerated, which is exactly what happens when AI assistants touch it.
It tells organizations how much of their code base an AI actually wrote, classifying code line by line with a confidence score, so engineering, security, and legal can see AI assistant output as a distinct risk category instead of an invisible one.
It inventories the AI your software depends on, the models, APIs, and frameworks built into the product itself, producing an AI bill of materials alongside the standard open source one.
Every match is reviewed and confirmed by a human before it's counted, and results export as audit-ready SBOMs and full reports.
You cannot verify an SBOM by reading the manifest that created it.
AI-written code is the same problem.
If a developer does not declare it, nothing records it.
You have to look at the code itself," said Taek Won Kim, President and CEO of Insignary.
New snippet-level scanning shows security and compliance leaders which open source code and which AI-written code never made it into a manifest.
Insignary Inc. today announced the general availability of Insignary Clarity Air, a source code scanning product built to answer a question most security teams can't currently answer with confidence: What is actually running in their software beyond what developers reported? Manifests and SBOMs built from declared dependencies are only as complete as what developers chose to report.
An estimated seventy to ninety percent of applications today are built substantially on open source code, and a meaningful share of it arrives through channels no manifest captures: a function copied from another project, a snippet pulled from a forum, a block an AI coding assistant generated and nobody reviewed line by line.
For a CISO signing off on an SBOM or a legal team certifying license compliance, that gap is unmanaged risk sitting inside a document meant to prove the opposite.
Clarity Air is built to close it at the source code level rather than the manifest level.
It finds open source your manifest doesn't know about, matching source code against Insignary's fingerprint database of the open source ecosystem.
Even when the code has been modified, adapted, or regenerated, which is exactly what happens when AI assistants touch it.
It tells organizations how much of their code base an AI actually wrote, classifying code line by line with a confidence score, so engineering, security, and legal can see AI assistant output as a distinct risk category instead of an invisible one.
It inventories the AI your software depends on, the models, APIs, and frameworks built into the product itself, producing an AI bill of materials alongside the standard open source one.
Every match is reviewed and confirmed by a human before it's counted, and results export as audit-ready SBOMs and full reports.
You cannot verify an SBOM by reading the manifest that created it.
AI-written code is the same problem.
If a developer does not declare it, nothing records it.
You have to look at the code itself," said Taek Won Kim, President and CEO of Insignary.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
