Pervaziv AI adds connected security workflow to Cortex Cloud

Pervaziv AI introduced Cortex Cloud Security Workflow on Sept. 23, extending its managed execution environment with static analysis, build validation, runtime assessment and release evidence. The company says the new workflow is meant to help teams trace AI-assisted code changes from source to the exact artifact that ran and was assessed.

Why it matters: - AI coding agents are moving from suggestions into implementation, testing and remediation, which raises the need to tie security checks to the exact software artifact under review. - Cortex Cloud Security Workflow is designed to connect source, build, runtime and evidence so teams can make release decisions with clearer context. - The workflow is meant to reduce the gap between source scans and runtime results, which can otherwise produce findings that are hard to verify against the actual release candidate.

What happened: - Pervaziv AI announced Cortex Cloud Security Workflow on Sept. 23, extending Cortex Cloud with a managed path for static analysis, software validation, runtime assessment and release evidence. - The workflow is built for eligible projects that move from a fixed source revision through static assessment, validation planning, a qualified image build, offline tests, runtime verification, bounded security assessment and release evidence. - Pervaziv AI said the release is aimed at software teams using AI coding agents for more of the development lifecycle. - The company also introduced the workflow as part of its broader Cortex enterprise AI control layer.

The details: - Cortex Cloud can examine project metadata, source and repository evidence before application code runs. - The workflow can consider manifests, lockfiles, continuous integration configuration, container definitions and available test evidence. - Static analysis, dependency checks and secret scanning provide pre-runtime risk coverage. - Cortex creates a deterministic validation plan tied to the source revision and the evidence used to create it. - Unsupported or ambiguous configurations are surfaced rather than guessed. - A dedicated build stage creates and qualifies an immutable validation image. - The workflow checks that source evidence and the approved plan still match the build. - Cortex applies controls to the build context, evaluates the container definition against cloud policy and records image identity and provenance. - Planned tests run in an offline container. - Cortex records test outcome, duration, exit status, bounded output and digests of complete output streams. - Failures can be classified as product failures, unavailable dependencies, resource limits or environment problems. - A passed test run is required before the workflow moves into runtime verification. - Runtime verification starts the application under a narrow declared contract. - The workflow can use a defined port, HTTP or TCP readiness checks, and bounded startup and observation periods. - Cortex records whether the application became ready, stayed healthy, exited unexpectedly or hit relevant resource conditions. - Once the validated image is healthy, the workflow can apply runtime assessment in several forms. - Scoped discovery maps resources reachable in the assessment environment within a fixed target and request budget. - Passive web analysis observes responses for issues that do not require an active attack sequence. - Curated HTTP checks evaluate the running target against a restricted set of supported security checks. - API examples and coverage testing compare declared API behavior with observed behavior. - Runtime assessment runs against a fresh instance of the validated image on an internal network without published host ports or external network access. - Results can be normalized, redacted where needed, fingerprinted and correlated into a single assessment with severity counts and discovery evidence. - A release evidence package can include static analysis, dependency and secret scan results, normalized build records, test results, runtime verification and security assessment records. - The package can also preserve the source revision, validation plan, configuration, image and artifact digests. - Release evidence may include a software bill of materials, release provenance, artifact integrity checks and signed attestations. - Cortex Cloud ties results to a shared release identity so later results cannot point to a similar image, a newer repository state or an unrelated validation attempt. - The workflow checks the relationship among the owner, workspace, source revision, plan, build, validation run and runtime specification before the next stage proceeds. - A clean assessment means the supported checks found no issue within their defined scope. - A clean assessment does not mean every endpoint, configuration, input or attack path has been tested, and it is not a guarantee that software is perfectly secure. - Cortex Connect maintains continuity of intent, progress and control across mobile, browser and Visual Studio Code experiences. - Cortex Discover adds an agentic AI browser with live page awareness, selected tab context, visual understanding and supported browser actions. - Cortex Cloud provides the managed execution environment for eligible work. - The latest inference cache architecture reduces repeated processing when eligible context, prompt prefixes or exact responses can be safely reused under validity rules. - Pervaziv AI positions the security workflow as an extension of that architecture, adding connected security and release evidence to work that runs in Cortex Cloud.

Between the lines: - The release is as much about traceability as it is about scanning. - Pervaziv AI is trying to make security evidence follow the same release candidate across source, build and runtime, instead of forcing teams to reconcile separate outputs from different tools or attempts. - That approach fits a world where AI-generated changes can move faster and create more review noise unless evidence stays tied to the artifact that actually ran.

What's next: - Pervaziv AI says the workflow is intended to help developers, security teams and engineering leaders review AI-assisted changes with more complete evidence. - The company is framing Cortex Cloud as a place where future AI work can be validated before release under known conditions. - The broader direction for Cortex is to keep intent, execution and evidence connected as AI agents take on more work.