Fighting fire with fire: Securing the AI DevSecOps factory

AI is changing how software teams build, test, secure, and ship code. In DevSecOps, that change is happening fast. Teams can now produce more code than ever. But trust, review quality, and security assurance are not growing at the same pace.

This talk explores what that means for modern software delivery. It looks at how AI is reshaping the SDLC and why DevSecOps must evolve with it.

DevSecOps was built to embed security into fast delivery. AI has pushed that model into a new stage.

Code is now easier and faster to create. That sounds like a clear win. But it also creates new pressure. Developers may not fully trust or understand the code they are shipping. Human review can become weaker. Security teams may face higher volumes, more noise, and less certainty.

At the same time, the threat landscape is not slowing down. Breaches are still expensive. Vulnerabilities are being discovered and exploited faster. This creates a serious gap between delivery speed and security confidence.

A lot of discussion about AI in engineering is either too optimistic or too vague. This session takes a more practical view. It argues that AI is not replacing DevSecOps. It is exposing its weak points and forcing teams to improve how they build trust, control, and security into delivery. The talk focuses on what is changing now, what is likely to change next, and where teams should stay cautious.

The session will cover how AI is increasing the speed and volume of code production, while also reducing confidence in some development and review practices. It will also explore where AI adds real value. This includes stronger SAST and SCA, more continuous DAST, easier policy-as-code, and faster creation of risks, controls, and threat models from code or architecture.

The talk also challenges the hype around full auto-remediation. AI will help with triage, explanation, and fix suggestions. But fully autonomous security changes in production are still unlikely to gain broad trust in the near term. Attendees will leave with a clearer view of how AI is changing DevSecOps in practice. They will better understand the main risks, the strongest use cases, and the likely direction of the field. They will also leave with a practical message: the goal is not to replace people. The goal is to reduce toil, improve feedback, and get closer to the secure, efficient, low-noise software delivery model teams have wanted for years.

This session is for security leaders, DevSecOps practitioners, engineers, architects, and platform teams who want a realistic view of AI in modern software delivery.