Cybersecurity company Rubrik has expanded its Project Hourglass initiative with a new tool intended to help organisations examine software code for complex vulnerabilities before that code reaches live systems. The announcement, made around the Rubrik GSI Summit in Goa, India, places artificial intelligence at the centre of a growing debate about how businesses should test software produced or modified with AI assistance.
The product, called Rubrik Code Guardian, is designed to examine copies of customer code repositories inside isolated environments. Rubrik says the system uses Anthropic’s Claude Mythos 5 through a specialised security framework to look for combinations of weaknesses that could be exploited together. The company also announced additional partners for its Project Hourglass alliance.
What Rubrik has announced
In its October 2026 announcement, Rubrik described Code Guardian as an extension of Project Hourglass, which already brings together security and recovery capabilities for organisations adopting AI-powered development and autonomous software tools. The expansion includes partners AHEAD, Trace3 and World Wide Technology, alongside existing alliance participants. Those partnerships are intended to support customer testing, deployment and training.
Rather than scanning only individual lines of code, the proposed approach is to examine how components interact across a wider software environment. A vulnerability in one service may be relatively limited on its own. Combined with an overly permissive identity role, an exposed interface or another weakness, however, it could become part of a more serious attack path. That distinction is important for security teams that receive large numbers of automated warnings and must decide which issues deserve immediate attention.
Why isolated testing matters
Rubrik says the tool conducts its analysis on a cloned repository in an air-gapped setting rather than directly on a customer’s live production environment. The stated aim is to reduce the risk that aggressive security testing could disrupt a running application or expose sensitive operational systems. Isolation does not, by itself, guarantee security, but it provides a clearer boundary between experimental analysis and live services.
The company’s description also emphasises business-impact prioritisation. A security team needs more than a long list of potential weaknesses: it needs evidence about whether an issue can realistically be exploited, which systems could be affected and what the likely consequences would be. Those judgments still require competent human review, especially where automated tools make assumptions about permissions, configuration or business processes.
The AI coding challenge
AI-assisted coding can accelerate routine development work, but speed can also increase the volume of code that organisations must review. Developers may accept generated suggestions without fully understanding their security implications. Traditional review, automated testing and access controls remain necessary even when an AI-based tool is introduced to detect weaknesses.
Rubrik cited research from its Zero Labs programme indicating that many cybersecurity and IT leaders expect the growth of AI agents to outpace existing organisational safeguards. That figure is a company-reported research finding, not independent proof that every organisation faces the same level of exposure. The broader issue is nevertheless practical: firms adopting AI tools need to decide who can authorise changes, what systems agents can access and how errors will be detected and reversed.
What businesses should check before adopting it
Prospective customers should distinguish between a product demonstration and a generally available service. Rubrik states that Code Guardian is in private preview and is accepting selected design partners. It is not yet generally available, and the company warns that features and performance may change. Organisations should therefore avoid assuming that the advertised capabilities are already deployable at scale.
Independent testing will be important. Buyers should ask how the tool handles confidential source code, how findings are validated, whether false positives can be measured and what evidence supports claims about detecting multi-step attacks. They should also establish who is responsible for reviewing recommendations and approving remediation work.
For Nigerian banks, fintech companies, telecom operators and other software-dependent businesses, the announcement illustrates a wider procurement question rather than an immediate instruction to buy a particular product. Security budgets should account for basic protections, staff expertise, backups, incident response and application testing alongside newer AI products. No single tool replaces those controls.
Rubrik’s expansion is a notable example of cybersecurity vendors adapting to AI-assisted software development. Its long-term significance will depend on whether customers can verify the promised benefits in real deployments, how well the system integrates with existing workflows and whether the company delivers a broader release beyond its current private-preview stage.
Image: Illustrative photograph of a server room by Kevin Ache, used under the Unsplash License. It does not depict a Rubrik event or product demonstration.
