Source-Level Fingerprinting Expands Security Oversight Across Modern Applications
Cybersecurity company Insignary has introduced Clarity AIR, a source-code analysis platform designed to identify undeclared third-party components, estimate AI-generated code contributions, and strengthen software supply-chain transparency.
Announced on October 8, 2026, the platform addresses a critical visibility gap: conventional Software Bills of Materials (SBOMs) may overlook code copied from external projects, manually modified, or produced using AI coding assistants.
Advanced Analysis Reveals Undocumented Components
Traditional software composition analysis relies heavily on package manifests and declared dependencies. These methods can miss externally sourced code embedded directly into applications.
Snippet-Level Fingerprinting
Clarity AIR compares source-code fragments against Insignary's open-source database to identify reused components, including modified or adapted code.
The approach aims to uncover hidden dependencies that could introduce vulnerabilities, licensing obligations, or compliance risks.
AI-Generated Code Identification
The platform also performs line-level analysis to identify potentially AI-generated code, assigning confidence scores to its findings.
This allows security teams to assess AI-assisted development activity and investigate code with undocumented origins.
However, AI authorship detection is probabilistic, and Insignary has not published independent benchmarks establishing the platform's accuracy.
AI Inventories Strengthen Supply-Chain Auditing
Clarity AIR supports the creation of an AI Bill of Materials (AIBOM) documenting AI models, APIs, and frameworks integrated into software applications.
Human-Verified Findings and SBOM Exports
According to Insignary, identified matches undergo human verification before appearing in final reports.
The platform also generates conventional SBOMs and detailed analysis reports to support vulnerability management, licensing assessments, and regulatory audits.
Clarity AIR complements two existing products:
- Insignary Clarity: Analyzes compiled binaries for embedded open-source components.
- Clarity SC: Supports SBOM governance and software supply-chain management.
Together, these capabilities provide visibility across source code, compiled applications, and dependency records.
Regulatory Requirements Increase Software Transparency
The launch comes as governments and regulators place greater emphasis on software provenance and supply-chain accountability.
Compliance and Risk Management
Insignary highlights several regulatory developments, including the U.S. Office of Management and Budget's M-26-05 memorandum, FDA cybersecurity requirements under Section 524B, and Canada's Critical Cyber Systems Protection Act.
Although these frameworks impose different obligations, they reinforce the need for accurate software inventories, risk assessments, and documented security practices.
Deployment Options and Product Availability
Clarity AIR is generally available through Insignary and its partners, with support for deployment on customer-controlled infrastructure.
Trial Access and Practical Limitations
Organizations can request trial licenses, while a free demonstration of the platform's AI-code detection capability is available through the company's website.
Its effectiveness in production environments will depend on detection accuracy, false-positive rates, and the quality of human validation.
The broader security implication is clear: knowing which dependencies developers declare does not necessarily reveal every component present in an application.
By combining source-code fingerprinting, AI-origin analysis, and existing binary inspection capabilities, Insignary aims to close that visibility gap and improve software supply-chain oversight.