Joseph Katsioloudes - Code Security Reinvented: Navigating the era of AI - AI Native DevCon June 26
AI is revolutionizing code security by helping minimize the gap between developers and dedicated security specialists. While AI tools like GitHub Copilot can significantly improve detection and, more critically, the speed of fixing vulnerabilities (the 'fixing problem'), they are not a replacement for human oversight. Responsible adoption requires utilizing structured protocols like Model Context Protocols (MCPs) and implementing agentic workflows within CI/CD pipelines to ensure deterministic, auditable, and context-aware security checks.
Key takeaways
-
AI's Role in Security Gap Reduction
18:04
The primary opportunity is using AI to scale scarce security expertise. While traditional static analysis tools (like CodeQL or Semgrep) are excellent for pattern matching, AI excels at modeling complex behavioral and contextual issues that pass standard checks.
-
AI Limitations: Hallucinations & Non-Determinism
4:00
The speaker notes that while AI is powerful, it should not be the sole safety net; good security hygiene remains paramount.
-
Leveraging MCPs and Skills
22:20
Model Context Protocols (MCPs) allow AI models to access server-side information from trusted sources (e.g., GitHub Security Lab findings), extending the context beyond narrow training data. Combining MCPs with structured 'skills' ensures that automated fixes are auditable, maintainable, and integrated into development processes.
-
Agentic Workflows for CI/CD
27:00
Agentic workflows allow security agents to run on a schedule or trigger automatically. They can perform sophisticated tasks, such as running manual security reviews automated by AI (using quantified knowledge from research) and proposing fixes directly within the Pull Request (PR), accelerating the fix rate.