When Renee Guttmann ran her first Open Worldwide Application Security Project (OWASP) meeting in New York City in the early 2000s, the general sentiment among the industry (and attendees) was one of skepticism: Why on earth would anyone care about scanning web applications for vulnerabilities?
Flash forward 20-plus years, and Guttmann, founder of security consultancy Cisohive, no longer has to beat down doors to get people to listen. Initiatives like OWASP, with its aim to improve software security, are now regularly invited into software development life cycle (SDLC) conversations to help developers and teams embed secure software practices across planning, testing, deployment and maintenance.
However, the ever-expanding attack surface and the increasing amounts of code written by non-developers or AI has made it more challenging to instill security into the SDLC. But experts also see opportunity, as increased collaboration among teams, better visibility into identities to identify the most vulnerable attack vector, and technologies that lower patching costs offer teams a blueprint for keeping pace.
The sheer volume of vulnerabilities being uncovered by AI and the rapidly evolving AI security needs mean the ways security has been integrated into the SDLC needs to be updated to fit the current threat landscape.
It’s A Great Time For Collaboration
During an exclusive Dark Reading roundtable discussion on shifting the SDLC security focus, Guttmann stressed that it is far easier to bring security and development teams together than it used to be. Security teams and CISOs have moved from being outsiders to sought-after collaborators as organizations recognize the importance of integrating security earlier and more frequently in software development. Security teams can do more from the onset in what she called “radical collaboration.”
Leadership, including boards and shareholders, is looking for more guardrails — not just policy, but the ability to implement solutions for writing clean code, she explained. Now is the time to go back to developers, including user developers outside of IT, and establish partnerships to embed security scanning more deeply into the development environment, she added.
“It’s a great time for us to exercise momentum that’s been built for us, to really be partners and active in the space,” said Guttmann.
Fellow roundtable panelist, Bobby Bauer, CISO of BlueFlag Security, highlighted communication between the security team and the rest of the company as a big opportunity in the space right now. There are “lots of things that people don’t know [that] security does for them,” he said. He pointed to legacy software, which often gets quietly secured in the background so updates don’t slow down business processes, as one primary example of work that goes unnoticed by the rest of the company.
“As we start to get included at the beginning of the process, then we’re also allowed to have a voice in that whole process as well,” Bauer said, calling it a “big improvement.”
“Fix That, and You Can Go As Fast As You Want”
There is no shortage of risk as organizations juggle long lists of vulnerabilities they need to patch, let alone all the possible issues hiding in open source components and AI-generated code that they don’t know about yet. But Bauer warned that the identity space is the most wide-open attack vector right now.
The current development lifecycle is flooded with non-human identities — a recent Entro report found that the average enterprise environment has 144 non-human identities for every single human identity. Applications, bots, AI agents, and devices can communicate with systems without human oversight, and that can lead to visibility challenges. If guardrails are not established, that could lead to shared, weak, or long-lived credentials that an attacker will find and abuse to breach an organization.
Recent studies have shown that there isn’t a single source of truth for these identities, especially non-human ones, said Guttmann. She added organizations may not know what they can access, or what level of authorization they have. She cited a Cloud Security Alliance study that found 68% of organizations can’t distinguish between actions performed by AI agents and those performed by humans.
Therefore, it’s important for organizations to provide short-lived credentials for these identities and establish a process to log the agent’s activity and the whole lifecycle, she recommended.
Security teams are using AI to develop code faster; that speed is not going away, and agents will make up a big part of it, Rusty Perry, former VP of cybersecurity strategy at Western Union, warned during the roundtable discussion. In order for teams to move fast safely, they need to ditch the assumption that they always know who or what is acting within their systems, he said.
“For me, it’s: fix that first and then you can really kind of go as fast as you want,” Perry said.
The boom in AI-generated code has upended the long-standing assumption that every line of code in an application was written by a human — one with clear intentions and accountability. Source code and the broader SDLC environment is a huge attack surface that has been traditionally underserved, Aftab Banth, former global enterprise head of security for TikTok, said during the roundtable discussion. He noted that BlueFlag gave organizations visibility into where gaps exist and the ability to quickly remediate those gaps.
BlueFlag also gives security teams direct visibility into which development tools have administrative rights to pipelines or repositories and breaks down barriers between security and engineering teams. Guttman said she didn’t realize how much risk she had in that area, particularly when it came to acquisitions.
“I always joke that it’s not the doors in your house; it’s a small one that you forgot about that ends up being your biggest risk,” Guttman said.
Does AI Actually Benefit SDLC?
However, even as AI has complicated the SDLC, AI models and tools also help organizations reduce costs, Banth said. Securing code can now be as cheap as creating it, which opens new creative avenues for security teams. While attackers are using AI to find vulnerabilities or develop exploits more quickly, Banth said remediation is the greatest benefit he has observed from AI in software security.
“We talk a lot about [vulnerability] velocity and sure, that has increased. But for the first time, the ability to fix, or at least find a patch, has become close to zero,” he added.
Guttmann agreed, noting that AI helps identify vulnerabilities at machine speed. The first time she conducted a system test in the early 2000s, a vendor charged her company $75,000 to test if the code was vulnerable. Now, she can’t imagine telling an organization it will cost that much to test one unit.
“I think the next shoe that’s dropping, if it hasn’t already, is the ability for AI to predict the impact of automating the patch or the fix,” she said. “I think AI is giving us that ability to actually apply patches and fix things more quickly, with greater confidence.”
