From IDE to production: Actionable ML-powered code security analysis
summary
Amazon demonstrates a cloud service that combines Amazon CodeGuru Security, Amazon Code Whisperer and Amazon Inspector to cut noise with ML and program analysis, claim a low false positive rate and produce actionable patch files that internally boost fix rates about 5x increase in fix rate. The system scans IDEs, CI/CD (GitHub/GitLab/CodePipeline) and production Lambdas, finishes scans in low single-digit minutes, tracks the same bug across revisions and exposes fixes as downloadable patches.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 2:07Customer experience
- 2:43Gating mechanisms
- 3:06Recurring themes
- 3:32Rule out across organizations
- 4:19False positives
- 4:47Challenges
- 5:46Bad actors are not sleeping
- 6:15Teams are not becoming more agile
- 6:25Positives
- 7:09Poll
- 8:37Context code analysis
- 9:18Context is everything
- 13:11The growth of code bases
- 14:10The domino effect of false positives
- 16:40Code Guru Security
- 21:04Challenges and solutions
- 23:02Integrations
- 24:36ID Integration
- 25:14Pipeline Integration
- 25:38Inspector Integration
- 26:17Demo
- 30:46Oops
- 31:04Omar
- 33:55AWS Native
- 38:36Bug Fix Tracking
- 43:11CodeGuru Security
- 45:40How to get started
related talks
54mKeeping your code secure
35mBring the power of machine learning to your developer operations
14mAmazon Q Builder: Securing your code
35mBring the power of machine learning to your developer operations
14mHow Security as Code Transforms Platform Engineering at Scale
20mThe New Stack: building software without limits
17mBetter availability and automated code reviews with ML
31mAmazon CodeGuru and CodeWhisperer for Java Developers on AWS