How AI is perceived in shift left of Appsec

Anitha Dakamarri, a longtime application security practitioner, opens by describing how AppSec teams work alongside developers across the software development lifecycle, from architecture reviews and threat modeling through code review, dynamic testing and penetration tests. She argues that generative and agentic AI will bring new strains: AppSec teams will need skills for AI systems, and they will need to coordinate with data science, legal and privacy groups, since AI output is non-deterministic and models change over time.

Mid-talk, she covers where AI could help. Threat modeling could be automated by reviewing design documents and suggesting attack scenarios that include data poisoning and prompt injection. AI-assisted static analysis could reduce duplicate and false-positive findings and offer context-specific fixes, and it could prioritize issues by severity and impact. For DAST, she describes context-aware crawling to find hidden APIs that scanners miss, and for pentesting she highlights attack-path analysis that follows an initial exploit through lateral movement. The discussion also covers software bills of materials and the gap between listing a library and knowing whether a vulnerable function is reachable, with VEX suggested as one way to close it.

She closes by framing the shift as safety left, where ethical and AI-specific risks join security concerns early in development. Her takeaways are that AI can improve developer experience through faster feedback, and that the field faces a shortage of engineers skilled in testing generative AI applications.