# Joseph Katsioloudes - Code Security Reinvented: Navigating the era of AI - AI Native DevCon June 26

## Executive summary

AI is revolutionizing code security by helping minimize the gap between developers and dedicated security specialists. While AI tools like GitHub Copilot can significantly improve detection and, more critically, the speed of fixing vulnerabilities (the 'fixing problem'), they are not a replacement for human oversight. Responsible adoption requires utilizing structured protocols like Model Context Protocols (MCPs) and implementing agentic workflows within CI/CD pipelines to ensure deterministic, auditable, and context-aware security checks.

## Key takeaways

- AI's Role in Security Gap Reduction: The primary opportunity is using AI to scale scarce security expertise. While traditional static analysis tools (like CodeQL or Semgrep) are excellent for pattern matching, AI excels at modeling complex behavioral and contextual issues that pass standard checks.
- AI Limitations: Hallucinations & Non-Determinism: The speaker notes that while AI is powerful, it should not be the sole safety net; good security hygiene remains paramount.
- Leveraging MCPs and Skills: Model Context Protocols (MCPs) allow AI models to access server-side information from trusted sources (e.g., GitHub Security Lab findings), extending the context beyond narrow training data. Combining MCPs with structured 'skills' ensures that automated fixes are auditable, maintainable, and integrated into development processes.
- Agentic Workflows for CI/CD: Agentic workflows allow security agents to run on a schedule or trigger automatically. They can perform sophisticated tasks, such as running manual security reviews automated by AI (using quantified knowledge from research) and proposing fixes directly within the Pull Request (PR), accelerating the fix rate.

## Technical details

- Code Security & Vulnerability Detection: AI can detect issues like SQL injection by identifying unsanitized, user-controlled variables. However, the speaker demonstrated that AI's ability to find vulnerabilities is highly dependent on providing specific context (e.g., linking a file suffering from prototype pollution) rather than just general code snippets.
- Security Tooling Comparison: Traditional static tools operate via pattern matching and have fixed costs/high confidence. AI is better suited for behavioral issues (e.g., data leakage due to incorrect behavior) that pass all syntactic checks.
- LLM as a Judge / Dual LLMs: A sophisticated mitigation technique involves using a second Large Language Model (LLM) to judge the output of the first. This helps validate security findings and is an advanced method for policy enforcement.

## Practical implications

- Integrate security checks into the Pull Request (PR) workflow to ensure fixes are applied immediately where code is developed.
- Adopt structured tooling using Model Context Protocols (MCPs) and defined skills to give AI agents reliable, scoped access to internal company data and scanner results.
- Implement agentic workflows that can run autonomously or on a schedule to perform automated security reviews, reducing manual effort in CI/CD.
- Focus developer education not just on adding functionality, but on secure coding practices by setting clear Service Level Objectives (SLOs) for security quality.

## Topics

AI Security, Secure Software Development Lifecycle (SSDLC), Agentic Workflows, Model Context Protocols (MCPs), Supply Chain Security, GitHub Security Lab, gh.io/taskflows, gh.io/ai dev risk, GitHub Copilot Trust Center

Source: https://www.youtube.com/watch?v=gc5_ICZg9tg