October 01, 2026
Welcome to Lucent Sky AVM version 2609 MR. This release introduces major advancements in application security visibility and software supply chain risk management. With new capabilities such as mixed-framework analysis, deterministic API discovery, post-quantum cryptography assessment, and exposure-based vulnerability prioritization, version 2609 helps organizations gain a more complete understanding of their attack surface while improving their ability to prioritize and remediate risk. To learn more about this release, visit the Lucent Sky AVM version 2609 release notes.
As Cybersecurity Awareness Month begins, take a moment to help a friend or family member improve their online security. Setting up a password manager, adopting passkeys, and enabling multi-factor authentication can have a bigger impact on cybersecurity than the latest blockchain-based AI guardrail.
With that out of the way, let’s look at the key new features and enhancements in Lucent Sky AVM version 2609.
Many enterprise applications span multiple languages, frameworks, and technology stacks. Whether the result of modernization efforts, mergers and acquisitions, or years of incremental development, assessing these applications often requires multiple security scans and separate review processes.
Version 2609 introduces mixed-framework analysis, enabling Lucent Sky AVM to analyze source code, configuration files, and dependencies across all supported technologies in a single scan. Languages running on a common runtime, such as C# and VB.NET or Java and Scala, are analyzed together, allowing data flow and control flow analysis to cross language boundaries and identify vulnerabilities whose execution paths span multiple languages. Findings from languages running on different runtimes are then correlated through hybrid analysis, providing a more comprehensive view of security risks across the application.
While the underlying analysis and remediation results are equivalent to those produced by multiple single-framework scans, mixed-framework analysis provides a unified assessment of application security across all supported technology stacks. For organizations conducting security assessments of large and complex applications, it simplifies scan management and review workflows while providing a more holistic view of security posture across the entire codebase.
Version 2609 introduces API discovery, a new analysis mode that automatically identifies web API endpoints directly from source code and configuration files. Unlike network-based API discovery approaches that depend on runtime activity or observed traffic, API discovery works entirely through static analysis. This allows organizations to identify APIs that may be dormant, undocumented, untested, or otherwise invisible during runtime scanning. By combining declarative analysis, functional analysis, and ML-augmented processing, Lucent Sky AVM delivers a more complete inventory of application APIs while reducing false positives and duplicate findings. During a four-month preview program, Lucent Sky AVM identified 181% more API endpoints than network-based solutions while producing zero false positives. This helps organizations gain a more complete understanding of their API attack surface and reduce security blind spots across their application portfolios.
As organizations seek greater visibility into risks associated with generative AI, Lucent Sky AVM expands its analysis of generative AI-related artifacts. Prompt files, agent definitions, skill files, Markdown documents, and related assets can now be assessed for potential prompt injection risks, including third-party content and components designed to influence generative AI behavior. This helps organizations identify prompt injection risks earlier, improve governance of generative AI-enabled workflows, and reduce blind spots introduced by rapidly evolving AI technologies.
While practical quantum computers capable of breaking today’s cryptographic algorithms do not yet exist, organizations are increasingly evaluating the long-term risks posed by quantum computing. Data encrypted today may remain sensitive for years or decades, creating exposure to “harvest now, decrypt later” attacks in which encrypted information is collected now and decrypted once sufficiently powerful quantum computers become available.
Version 2609 introduces post-quantum cryptography (PQC) analysis, helping organizations understand where quantum-vulnerable cryptographic algorithms are used within their applications. Rather than simply reporting the presence of cryptographic libraries, PQC analysis evaluates how cryptographic APIs are actually used and identifies code paths that depend on algorithms that may become vulnerable to future quantum-based attacks.
This capability helps organizations inventory affected applications and cryptographic implementations, assess long-term exposure, prioritize modernization efforts, and develop practical migration strategies toward post-quantum cryptographic standards.
Building on these analysis capabilities, version 2609 also introduces post-quantum cryptography remediation for customers participating in the Lucent Sky AVM Preview Program. Using Lucent Sky’s deterministic remediation technology, the platform can generate Guided Fixes that help migrate application code from classical cryptographic algorithms to suitable post-quantum alternatives while maintaining transparency, control, and human oversight throughout the remediation process.
Software supply chain risks continue to grow as organizations rely on an ever-expanding ecosystem of third-party and open-source components. While most applications contain vulnerabilities in dependencies, not every vulnerability carries the same level of risk.
Version 2609 introduces Exposure Score, a new risk-based metric designed to help organizations prioritize vulnerable third-party and open-source components more effectively.
Unlike Secure Score, which measures the overall security posture of an application, Exposure Score focuses specifically on dependency risk. It combines vulnerability intelligence, known exploitation activity, predicted likelihood of exploitation, and application context to identify which vulnerable components are most likely to pose real-world risk.
By incorporating both threat intelligence and organizational context, Exposure Score enables security teams to prioritize remediation efforts based on the risks most relevant to their environment. As a result, the same vulnerable component may receive different prioritization in different organizations depending on factors such as industry exposure, usage patterns, and reachability within applications.
Version 2609 also adds support for uv packages within Python dependency analysis, further expanding ecosystem coverage for modern Python development workflows.
Version 2609 includes several enhancements designed to simplify enterprise deployments and strengthen integration with existing development and security workflows.
Service hooks now support more granular scopes, providing greater flexibility for event-driven integrations and automation. Organizations can create more targeted workflows for CI/CD pipelines, external systems, and security operations processes. Service hooks can also be used to trigger notifications when vulnerable dependencies are discovered or when their exploitation is predicted or observed.
For organizations deploying Lucent Sky AVM on-premises, version 2609 adds support for Microsoft Entra ID authentication. This provides an alternative to Active Directory for authentication and identity management while simplifying integration with modern enterprise identity platforms.
For customers with managed Lucent Sky AVM instances and Lucent Sky AVM On-Demand, your instances will be updated to 2609 MR in the coming days, unless affected by backward compatibility issues or an opt-out is in effect.
For customers with on-premise Lucent Sky AVM instances, you can update to 2609 MR immediately. Our support team will reach out shortly to schedule the update.