From Noise to Notes: Orchestrating SAST with Developers... (Adrián Puente Z.)
summary
Walkthrough shows how a SAST rollout uses Snyk Pro and Semgrep to cut 5,000 noisy findings to ~800, prioritize by business risk and scan 40% of repos that cover 95% of real risk. It embeds checks in PRs, Slack and Jira, adds rule memories, and builds a GPT companion plus AI-driven Vibe Security Patching that generates focused fixes (laser prompts, cloned code, PRs). Outcome: remediation time drops from 130→17 days and 78 high-severity issues become 3 PRs in a week, so the approach demonstrably works.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker intro
- 1:02The SAS promise vs reality
- 3:08From noise to notes journey
- 4:32Choosing the right SAS tool
- 6:20Overwhelming findings problem
- 7:22Turning noise into signal
- 9:26Prioritizing by business risk
- 10:29Orchestrating with developers
- 12:58Measuring adoption and success
- 15:05AI-driven remediation approach
- 18:37Vibe security patching results
- 20:50Transformation with AI and empathy
- 21:32Key takeaways for Monday
- 24:42Next steps for SAS programs
- 26:50Q&A session
related talks
26mSecurity Automation For GraphQL
57mDev-first security: From code to cloud, and back to code (PRT291)
48mThe Quick Wins of DevSecOps
43mDevSecOps on steroids - Powered by your Selenium tests
54mOvercoming The Inundation Of Noisy Security Alerts
40mDevSecOps Guide to Bulletproof Your Development Workflow
47mRollercoaster of Security Automation
46mSecurity DevOps - Staying Secure In Agile Projects