Rubrik (NYSE: RBRK) is expanding its Project Hourglass partner program with Code Guardian, an AI-assisted service intended to test cloned enterprise code repositories for multi-step cyberattack paths before they reach production. The move gives additional systems integrators access to a controlled code-security workflow as organizations adopt AI-assisted software development without widening their operational attack surface.
For enterprise IT leaders, the practical question is whether AI coding tools can accelerate delivery without forcing security teams to triage an even larger volume of alerts. Rubrik said Code Guardian runs Anthropic’s Claude Mythos 5 inside its security harness against an air-gapped copy of a customer’s repository, rather than a live repository or production environment. It is designed to examine relationships among files, services, identity roles and cloud boundaries, then validate whether a potential attack chain is exploitable.
Isolated Testing Shifts the Security Boundary
Traditional code scanning often produces findings that still require engineers to determine whether a weakness can be chained with other conditions to create a material business risk. Rubrik is positioning Code Guardian as a layer that tests those chains in isolation and scores confirmed findings by exploitability and business criticality. The company said the service can also send confirmed critical issues to developer workflows through issue-management systems with file-level remediation guidance.
That architecture matters because source code, identity permissions and cloud configurations increasingly intersect in the same application delivery process. A vulnerability that appears modest in one component may have broader consequences when it can be combined with an exposed service or privileged role. An isolated test environment does not eliminate the need for application security controls, review practices or production monitoring, but it can give teams a safer place to investigate whether a theoretical finding represents a credible attack path.
Partners Turn a Product Preview Into an Enterprise Delivery Test
Project Hourglass began as Rubrik’s program for deploying its Agent Cloud service with partners. By adding Code Guardian, the company is extending the program from runtime behavioral guardrails and recovery controls to code-repository testing before deployment. Rubrik said the expanded alliance adds three systems integrators to a group of existing delivery partners.
The partner model is significant for enterprises that buy security and modernization work through systems integrators rather than adopting a new platform on their own. Those firms can combine a code-testing process with implementation, governance and incident-recovery services, although Rubrik did not disclose customer deployments, pricing or an availability schedule. The company also said Code Guardian is in private preview for select design partners, is not generally available and may change or be discontinued.
Why Code Recovery Joins AI Code Security
Rubrik’s approach adds a recovery dimension to the familiar promise of AI-assisted vulnerability analysis. The company said the service maintains workflows for restoring a known-good codebase after a security event or bad build. That could be useful when an AI-enabled development process introduces defects or when a compromise affects source-control assets, but the company has not published independent performance data for the service.
The competitive distinction is therefore not simply using a frontier model to find flaws. Rubrik is attempting to tie model-assisted analysis, exploitability validation, remediation workflow and code recovery into one enterprise security process. Legacy scanning tools can leave teams with disconnected alerts, investigation queues and backup procedures. If Code Guardian reaches general availability with the controls described, it could give organizations a more integrated way to assess AI-era code risk while preserving a recovery path when prevention fails.