Keeping software secure as AI speeds up development

From thousands of findings to the few that matter

Project overview

DevSecOps has become a growing priority across the software development industry, driven by the added complexity of AI-based development. In response, Senior Tech Lead, Sapumal Perera built an internal platform that makes existing security scanners more useful: it filters, deduplicates and prioritises their findings so teams can focus on what matters. 

The problem

AI-assisted development means teams can now ship hundreds of files a day, far more than anyone can review by hand. Meanwhile, threats are more advanced and regulators are making security compliance mandatory.

Security scanners help, but they produce hundreds or thousands of findings per scan. Many are false positives or duplicates, and none come with context: a scanner can flag a SQL injection risk, but not whether that code is ever called or sits in a critical, internet-facing service.

So engineers triage every finding by hand, which in regulated environments can take multiple sprints. Large enterprises absorb the cost; smaller companies often can’t.

Insight and approach

The insight: teams don’t lack scanners, they lack usable output. As Sapumal puts it: “We are not adding another security scanner. What we are doing is creating a platform for security scanners.”

• Tool-agnostic. It works on top of any open-source or commercial scanner, including tools a client already uses.
• Deterministic first. Security results must be reproducible, and AI agents are probabilistic. So the core runs on deterministic rules and quality gates, with an agentic layer planned on top.
• Nothing discarded. Findings are prioritised, never deleted, and every decision is logged and traceable.

Implementation

Findings pass through a series of layers: scan, deduplicate within and across tools, group, enrich using vulnerability databases, and finally apply context. Is the service critical? Is it internet-facing? Has this been flagged before?

The platform scans a snapshot of code and infrastructure and never sits inside a client’s CI/CD pipeline, so it can’t block delivery or introduce new risk. Adding a new scanner is as simple as adding a folder.

Sapumal tested it on repositories seeded with known vulnerabilities and on Boomerang, an internal .NET project, which showed where more rules were needed for codebases without infrastructure-as-code files.

Impact

In test runs, the deterministic layers cut scanner noise by around 70%, returning engineering hours and reducing the risk of critical issues being missed.

The next phase adds the agentic layer, with a goal of around 95% noise reduction: thousands of findings narrowed to roughly 10 to 15 critical items, with suggested fixes. The platform has not yet been used with external clients; client validation comes next.

Who it’s for

• Large organisations with many microservices, where scanner output has become too much to manage.
• Smaller companies with no DevSecOps team, which need to meet security and compliance requirements. For them, the platform is planned as a managed service: an Ascentic engineer runs the scans and delivers prioritised findings, for example as Jira tickets.
• Organisations working towards compliance. Longer term, the platform aims to report gaps against frameworks such as SOC 2, NIST and the EU AI Act.

Technologies used

Python, Docker, open-source security scanners, GitHub CI/CD and vulnerability databases, with AWS planned for the agentic phase.