Conquering Vulnerabilities: Human-Led, AI-Supported Code Surveillance

The talk argues that AI helps secure code review only when a human stays in charge of every step. Reading code is a distinct skill, and reviews are often squeezed or skipped. Instead of line-by-line reading, the approach concentrates on the parts of an application that hold the most valuable assets, tracing data flows toward them. AI speeds up summarising and triage, while people supply intent, business logic judgment and common sense.

The middle of the talk covers a staged workflow packaged as a Claude skill: business context, assets, attack surface, data flows, then a report. A reviewer checks each stage before it feeds the next, because early hallucinations would otherwise propagate. In a live demo on an older personal project, the tool flagged an unauthenticated MCP server over SSE as the most critical issue and produced a report with fifteen findings the speaker judged valid. The run took hours and many tokens, and the tooling was described as alpha quality.

To close, the talk proposes re-running the pipeline on each push, restarting from whichever stage a change affects and having a human review only the deltas. The core trade-off is speed versus coverage, and false positives can quickly erode trust with developers. AI should be treated as an assistant, not an authority.