📕 AI-Powered AppSec: 10x Your Security Team Without Scaling Headcount 🖥️
summary
Built an internal platform called Priscia that runs CI hooks into a Flask backend, stores artifacts in DynamoDB, and queries multiple LLMs (Sonnet/Opus and GPT) with a multi-model consensus to analyze PRs, triage SAST findings using Sourcegraph code context, and auto-review design docs. It finds real auth/IDOR bugs in first‑party code — 30 true positives (4 critical, 16 high, 10 medium) — and cuts spec reviews from days to minutes while keeping humans in the loop.
AI-written summary · about
chapters (13)
- 0:00Introduction and context
- 2:29Security scaling crisis
- 10:37Automated PR security analysis
- 18:33SAST smart triage
- 26:37AI-powered design reviews
- 29:33Advanced agentic workflows
- 31:18Key lessons and best practices
- 32:41Iteration and noise reduction
- 35:36Complexity and cost management
- 36:10Context engineering and staging
- 36:54Bias to action and prototyping
- 38:11Building your own platform
- 39:32Q&A session
related talks
57mWhat’s in an AppSec program?
41mAppSec From the Ground Up
23mAI assisted code reviews Quality and Security at Scale
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
51mTaking AppSec to 11: Pipelines, DevOps and making things better
47mHow to 10X Your Company’s Security (Without a Series D)
29mOne-Click Code Fix: Securing Code Using AI
15mInterview with