DevSecOps as a Launchpad

The talk opens by framing security as a source of friction in fast delivery cycles, especially as AI-assisted coding speeds up feature work. The speakers trace the shift-left idea from its origins toward checks throughout the lifecycle, then walk through the DevSecOps toolchain: static analysis that inspects source code, dynamic testing that probes a running application, and dependency analysis that checks third-party components against vulnerability databases. They point to fragmented tooling, false positives and slow feedback as recurring pain points that push developers away from security processes.

The middle section surveys recent AI and data regulation, including a US executive order, the EU AI Act, DORA, India's privacy law and the NIST AI risk management framework. It then turns to AI-generated code, where training data, outdated dependencies and non-deterministic output can introduce weaknesses. The speakers explain the Model Context Protocol as a way to give models structured, controlled access to tools and data, and outline the host, client and server roles along with local and remote server deployment.

The closing vision is to connect scanners to MCP servers so the coding assistant runs SAST and SCA while code is being written, letting many findings be fixed before commit and reducing pipeline iterations. In audience questions, the speakers acknowledged that MCP servers carry their own risks, that data exposure must be managed, and that scanner latency inside the IDE is an open concern. The takeaway is to make security tooling seamless for developers while governing which servers and tools are trusted.