AppSec in the Age of Agentic SDLC — Session Summary
8 security practitioners attended | Focus: AI’s impact on SCA, SAST, DAST, Threat Modeling and AppSec in general

Developer-Security Alignment
A recurring theme was the lack of incentive on the engineering side to prioritize security. The consensus was that security teams need to meet developers where they are. Adopt the same tools and workflows as engineering and communicate findings in terms of business impact rather than technical severity alone.
The baseline was established that no amount of technology can remedy cultural issues in an organization.

Code Attribution & Review Burden
AI-generated code complicates attribution, making it harder to trace intent and ownership. This shifts more responsibility onto reviewers, raising questions about how to keep pace with PR volume without compromising review quality. Some risk is being accepted as a practical tradeoff.

Security Workflows
Current workflows discussed ranged from design → pentest → CI/CD automation to vuln management pipelines involving PR flagging, code changes, and spot checks. Tooling in focus included source code review, secret detection, and automated threat modeling. The latter is emerging as a key area where AI is adding value.

Trust & Exploitability
There’s an open question around trusting AI-recommended packages for remediation. Specifically on dependencies in SCA.
The group discussed the downsides of blanket patch-everything approaches, citing real costs: major version upgrade timelines, runtime regressions, exploit reachability, and infra compatibility.
Exploitability-based triage is gaining traction as a more practical framework. But overall everyone was in agreement that this is evolving and we will soon reach a point where agents will be smart enough to recommend the correct versions of packages and SCA could be a solved problem.

Documentation
Adequate documentation of tools and business context was flagged as critical both for AI systems making recommendations and for maintaining institutional knowledge as codebases evolve rapidly. The importance of AI tools having proper context was highlighted and it is going to be even more critical as these tools evolve.

AppSec in the age of Agentic Software Development

{{ gettext('Draft') }}