When AI Joins the Pipeline: Rethinking DevSecOps

Transcript

1. DEVSECO PS × AI WHEN AI JOINS THE PIPELINE Rethinking DevSecOps for agents, adaptive security testing, and a new trust model. Sena Yakut, 2026
2. ABOUT ME! Sena Yakut Senior Security Engineer @Trendyol AWS Security Hero
3. DevSecOps was built for predictable actors The classic model assumes clear ownership, bounded identities, and deterministic automation. DEVELOPER CODE CI / CD SECURITY CLOUD Human intent Known artifact Deterministic steps Policy + scanners Machine identity The pipeline executes. It does not decide what the goal should be. W H EN A I JOIN S T H E P IP EL IN E BAS ELINE: C LAS SIC D EVS EC OPS 3
4. Then AI joined the pipeline At first, it looked like one more productivity layer. DEVELOPER CODE CI / CD CLOUD Human intent AI-assisted Same pipeline Same target AI ASSISTANT Generate • explain • suggest Initial security question “What if AI writes vulnerable code?” W H EN A I JOIN S T H E P IP EL IN E Important question. But not the biggest change. PHA SE 1: AI A S A SS IST ANT 4
5. Then it learned to act When AI can choose and call tools, it stops being “just another editor feature.” AI AGENT </> GIT CI / CD Read / change code Trigger workflows SECRETS CLOUD Use credentials Change resources SECURITY DATA / APIs Read findings Call systems The security question changes: What can the agent become, reach, and change? W H EN A I JOIN S T H E P IP EL IN E PHA SE 2: AI A S A CT OR 5
6. AI joins the pipeline twice First as a developer. Then as a security engineer. EN TRY #1 EN TRY #2 AI as DEVELOPER AI as SECURITY ENGINEER - Generates code - Changes infrastructure - Calls build systems - Iterates on feedback - Interprets findings - Prioritizes context - Proposes remediation - Adapts tests and retests Creates new risk Changes security itself AI is not just another stage in the pipeline. It can span the pipeline. W H EN A I JOIN S T H E P IP EL IN E T HE C ORE THES IS 6
7. The trust model changes Traditional controls still matter. Their assumptions are what change. BEFORE WITH AGENTS CODE Human-written artifact Agent-generated + continuously modified IDENTITY User or machine role Agent identity + delegated identities PERMISSION Allowed API actions Allowed actions + tool reach + autonomy EXECUTION Deterministic workflow Reasoning loop chooses next action EVIDENCE Logs show what happened Need intent + tool calls + decision chain Security now has to reason about both privilege and behavior. W H EN A I JOIN S T H E P IP EL IN E T RU ST MOD EL SHIFT 7
8. New actor, new attack surface The agent becomes a junction point between instructions, tools, identities, and data. EXCESSIVE AGENCY INDIRECT PROMPT INJECTION UNSAFE TOOL CHAINING AGENT CONTEXT / SECRET LEAKAGE TOOL POISONING IDENTITY CONFUSION The attack surface is no longer only code. It includes the path from context → reasoning → action. W H EN A I JOIN S T H E P IP EL IN E T HREA T M OD EL 8
9. Least privilege is necessary, but not sufficient We also need to minimize how much independent action an agent is allowed to take. PRINCIPLE OF LEAST PRIVILEGE PRINCIPLE OF LEAST AGENCY “What APIs can this identity call?” “What decisions can the agent make alone?” • Resource scope • Actions • Conditions • Duration • Tool reach • Action sequencing • Approval boundaries • Autonomous retries Permission limits capability. Agency limits autonomy. W H EN A I JOIN S T H E P IP EL IN E NEW D ES IGN P RINCI PLE 9
10. Security must surround the agent OBSERVABILITY POLICY GATES Do not rely on the agent to self-police. TOOL CONTROL Constrain the environment around it. IDENTITY AI AGENT W H EN A I JOIN S T H E P IP EL IN E D EFENSE M OD EL 10
11. Security testing changes in two directions AI changes how we test software, while AI software changes what must be tested. AI + SECURITY TESTING AI-ENHANCED TESTING TESTING AI SYSTEMS Existing controls gain reasoning, context, remediation, and adaptation. New systems introduce behavior paths that traditional scanners do not cover. SAST • DAST • SCA • Pentest Prompt • Tools • Context • Agency W H EN A I JOIN S T H E P IP EL IN E T HE S EC OND BIG SHIFT 11
12. SAST: findings become feedback loops Static analysis stays valuable. AI adds context, prioritization, remediation, and iteration around it. SAST moves from “find the issue” toward “understand → fix → validate.” Important: deterministic analysis remains a trusted signal. AI is the reasoning layer around it. W H EN A I JOIN S T H E P IP EL IN E SA ST EV OLU TI ON 12
13. DAST: scanning becomes adaptive testing The next request can be chosen based on what the application just revealed. The scanner stops asking only “Did this payload work?” and starts asking “What should I try next?” W H EN A I JOIN S T H E P IP EL IN E D AS T EV OLUT ION 13
14. From payloads to hypotheses Adaptive testing can follow application state, business logic, and chains of evidence. APPLICATION STATE REASONING LOOP LOGIN ACCOUNT session role ORDER ADMIN workflow privilege 1 What changed after login? 2 Can role boundaries be crossed? 3 Does workflow state unlock a path? 4 Can two low-risk issues chain? Runtime testing becomes more about paths through state, not just isolated endpoints. W H EN A I JOIN S T H E P IP EL IN E A DA PT IV E OFFENSIV E TE ST ING 14
15. We still need to test the AI itself Traditional application security covers code paths. AI systems also introduce reasoning and action paths. PROMPT INJECTION TOOL ABUSE AUTHORIZATION Can untrusted content steer behavior? Can the model invoke unsafe actions? Can it cross identity boundaries? DATA LEAKAGE MEMORY / CONTEXT POISONING UNSAFE AGENCY Can context or secrets escape? Can durable context be corrupted? Can it take high-impact actions alone? We used to test code paths. Now we also need to test reasoning paths. W H EN A I JOIN S T H E P IP EL IN E NEW T ES T TA RGETS 15
16. W H EN A I JOIN S T H E P IP EL IN E
17. One unsafe request. Two very different outcomes. Example: “Make the internet-facing app work. Remove connectivity restrictions.” WITHOUT GUARDRAIL S WITH G UARDRAILS Agent interprets the request 0.0.0.0/0 Inbound access Policy gate rejects change Deploy succeeds Agent remediates + retests Functional W H EN A I JOIN S T H E P IP EL IN E Agent proposes the same change Secure Functional Secure SC ENA RI O 17
18. DevSecOps 2.0 A continuous loop where creation, testing, policy, and remediation all exchange feedback. W H EN A I JOIN S T H E P IP EL IN E T ARGET A RCHIT EC TU RE 18
19. The New DevSecOps Loop W H EN A I JOIN S T H E P IP EL IN E T ARGET A RCHIT EC TU RE 19
20. What should change on Monday? Start with architecture and controls, not a new security shopping list. 01 Separate agent identities 02 Do not blur human, CI, and agent execution contexts. 03 Constrain tools Decide which actions require approval, not only permission. 04 Scope what tools can be called, with what parameters, and in what sequence. 05 Capture the action chain Log trigger → context → tool call → identity → API action → result. Define least agency Keep policy deterministic Use enforceable gates for cloud, IaC, secrets, and deployment boundaries. 06 Test both code and behavior Keep SAST/DAST, then add adversarial tests for AI reasoning and actions. The goal is not “trust the AI.” The goal is “design a system where trust is unnecessary.” W H EN A I JOIN S T H E P IP EL IN E PRA CT IC A L T AK EAW A YS 20
21. DevSecOps is not disappearing. It is getting a new team member. Questions?