Insignary Debuts Clarity AIR to Uncover Hidden Open‑Source and AI‑Generated Code in Enterprises

Toronto‑based security firm Insignary announced on October 8, 2026 the launch of Clarity AIR, a new scanning solution designed to expose undeclared open‑source components and AI‑written code hidden within corporate software repositories.

Organizations that build applications with third‑party libraries often struggle to maintain an accurate inventory of the code they actually ship. Undocumented dependencies can lead to inadvertent license breaches, expose unpatched vulnerabilities, and create blind spots for supply‑chain risk management.

Clarity AIR tackles the problem by performing snippet‑level static analysis combined with machine‑learning models that match code fragments against a curated database of open‑source projects and known AI‑generation patterns. The tool generates detailed reports that pinpoint the exact location of each identified snippet, allowing teams to trace its provenance.

For security and compliance officers, the granular visibility promises a clearer picture of licensing obligations and potential security exposures. By surfacing code that was never declared in a software bill of materials, Clarity AIR enables faster remediation and more consistent enforcement of corporate policy.

The timing aligns with a broader industry shift toward greater transparency in software supply chains. The proliferation of AI‑assisted coding tools such as GitHub Copilot has amplified the volume of machine‑generated code, prompting regulators and standards bodies to tighten expectations around software bill of materials (SBOM) completeness.

Insignary, which has previously focused on software‑supply‑chain risk analytics, says the new product expands its portfolio into the emerging niche of AI‑code detection. The company highlighted early interest from financial services and healthcare firms, sectors that face strict compliance regimes and have been targeted by recent high‑profile supply‑chain attacks.

Looking ahead, Insignary plans to integrate Clarity AIR directly into continuous integration and continuous deployment (CI/CD) pipelines, offering real‑time alerts as code is committed. The firm also hinted at future collaborations with open‑source foundations to keep its reference database current.

Analysts note that while tools like Clarity AIR can significantly narrow the gap between declared and actual code, they are not a substitute for comprehensive governance frameworks. Effective risk mitigation will still require disciplined processes, regular audits, and ongoing education of development teams.