Automation of Security Scanning: Easy or Cheese
summary
Describes integrating SAST and DAST scanners into CI using ReportPortal, Carrier platform and Jira to reduce manual triage of noisy scan results (many false positives). Presents a CI bot that auto-creates actionable Jira tickets with code snippets, a canonical converter to normalize different scanner outputs, and an auto-analysis workflow that runs across 60+ projects to speed scans (results in ~10 seconds, target 5–10 minutes) and reduce retriage.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:31Security testing
- 4:00Penetration testing role
- 5:43Automation benefits
- 7:11Security engineer tasks
- 9:47CI/CD pipeline integration
- 11:10Practical automation example
- 13:36Lessons and effectiveness
- 15:50Project setup automation
- 18:22Scan speed optimization
- 20:34Managing integrations
- 22:00Report standardization
- 23:30Automated result analysis
- 26:02Jira ticket creation
- 28:11User experience focus
- 29:16Karter demo
- 35:08Conclusion & Q&A
related talks
47mRollercoaster of Security Automation
27mStandard Classification: Automate Security, Don't Tell Your Boss
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
21mAdding DAST to CI/CD, Without Any Losing Friends
19mApplication Security at High Velocity
20mAI-Driven Security as Code in Jenkins
43mBuilding a Secure DevOps Pipeline
47mAutomated Security Scanning in Payment Industry