AI from DevSecOps

The talk opens with the speaker's view that AI gives security teams speed and scale, such as drafting a threat model in seconds that might otherwise take weeks. That time can go toward thinking about what attackers are actually doing. She traces how DevSecOps grew from small beginnings and argues that moving pipelines from automated, continuous checks to agent-driven ones will take a similar organic effort, with budgets and vendor roadmaps shifting along the way.

The middle section covers how to prepare. Agents tend to handle bounded problems and numeric goals better than loose wording, so she recommends starting with goal-oriented metrics, such as a "securability" score that rises when developers do well and falls when they do badly. Other building blocks include a capability map, a risk matrix, and an adversary scorecard that groups threats into profiles. Those profiles can trigger threat models, which in turn produce test cases and alerts that can be measured against adversary coverage. Human review stays in the loop, and several cooperating agents, coordinated by an orchestrator, are needed rather than one.

The closing portion turns to practical steps: mapping where agents fit, using prompts and shared tools to build these artifacts, and asking vendors for metric-driven reporting instead of relying only on questionnaires. The speaker concludes that the security job is changing rather than disappearing, and urges attendees to sharpen their prompting and choose a concrete next step.