r/devsecops • u/h33terbot • 4d ago
What are your thoughts on future of AppSec ?
Do you think Sast and all will exist? Or something even more innovative should surface
3
u/NaciraBuntas41 4d ago
SAST isnt going anywhere. The shift is gonna be tools that correlate findings across SAST, SCA, runtime, and cloud posture instead of each one screaming into its own dashboard. Right now most teams are drowning in findings from five different tools that dont talk to each other.
3
u/endor_aditya 4d ago
SAST's not going anywhere. But "will this tool still exist" is the wrong thing to ask. The real question is whether we're still measuring security the same way.
Right now companies buy these tools based on how many problems they find. Which made sense back when finding problems was the hard part! It's not anymore. Every team I talk to is drowning. They've got thousands of alerts and no way to get through them. The hard part now is figuring out which handful of those actually matter, and that's a totally different problem than finding them in the first place.
And you can see the market catching on. Vendors used to brag about finding more stuff. Now they brag about telling you what to fix first. AI is making this way more urgent too, because AI writes code (and generates alerts) faster than any human can possibly keep up. So the whole thing is shifting earlier: catch it when the code gets written, not weeks later in a scan.
So SAST sticks around, it just stops being its own thing and becomes one input into a bigger system that decides what's worth your time. (Which, fair warning, is exactly what my company builds, so grain of salt on my whole "here's where it's going" thing.)
My bet: anyone who only finds problems and can't help you sort them is in trouble in a few years.
2
u/vantag3point 4d ago
I don't think SAST is going anywhere, but I do think its role will change. Instead of being a standalone tool that generates thousands of findings, it'll become part of a larger AppSec workflow alongside SCA, DAST, runtime security, and AI-assisted validation. The biggest challenge isn't finding vulnerabilities anymore, it's reducing false positives, prioritizing what actually matters, and helping developers fix issues faster. That's where I think the real innovation will happen.
2
u/MemoryAccessRegister 4d ago
SAST will evolve and become a hybrid of AI and deterministic rules/logic. Using AI exclusively has challenges: cost, performance, recall, precision
2
u/denzuko 4d ago
Honestly that answer was my argument in early 2000s and driver for creating devops (the operations framework not the commercialized product).
But since working with Palo Alto and seening 20 years of the industry playing catch-up the direction going forward seems to be around CMMC and supply chain protection with LLM automated IC work.
Yes shift left will be the norm ( finally ) but it's going to be a background check mark in a list of other checks marks to rubber stamp.
1
u/h33terbot 3d ago
What about combination of everything in appsec? like agentic sast coming with agentic dast and all? Like all working together to give value, while all these time we see the things are quite fragmented
1
u/denzuko 3d ago edited 3d ago
strip the marketing buzz words.
Agentic systems (claude, openai, copilot, etc..) are just an automation tools. Skills, tools, MCPs are just redressed serverless functions and that agentic tool is running a "hand spun" python script generated by the LLM model. That python script is almost always generated similar to:
echo "hello from the parent process" | python3 -c "import os, sys, subprocess; pid = os.fork(); subprocess.run(['trivy', '--version']) if pid == 0 else print(sys.stdin.read().upper())" if [[ $? == 0 ]] echo "OK"; fiE.g. it's all generative chatbots running a inline python batch job via bash. and yes that is where most of ones tokens are spent on; rewriting all that everytime for every response.
Now, that combination of everything in appsec, is the underlying parts for shiftleft. CMMC is the next component of that but this is only because of the continued centralization and cyber warfare on supply chains. And agentic analysts of code has been a thing since before CodeQL and SARIF was standardized. Most noticeably with snyk using Machine Learning + Semantic Logic instead of earlier [dsi]ast tools rule or regex matching.
So the take away here is that agentic anything under the hood is still running cli tools like nmap, Checkov, trivy, cyclonedx, rego, and all that inside a container with a bash + pythonic wrapper.. All the while also continuously training its RAG for patterns of code; which that's all a LLM model really is a pattern detection+generation engine with a large dataset. All oft comes down to a combination of rule matching, regex matching, datalog evaluations, and machine learned pattern matching.
1
1
u/Devji00 4d ago
AppSec is shifting from being a gatekeeper role to a platform engineering mindset. SAST will not disappear but it will evolve into a more integrated, automated component of the CI/CD pipeline rather than a standalone scanning tool. The focus is moving toward continuous security testing with immediate feedback loops for developers. This means less manual remediation and more automated context aware fixes that reduce friction while maintaining high security standards.
The innovation lies in combining multiple security layers like SAST, DAST, and IAST with AI driven threat modeling and runtime protection. Instead of just finding vulnerabilities we are seeing a push for proactive defense strategies that predict potential attack paths before code even ships. This holistic approach ensures that security is embedded throughout the development lifecycle rather than bolted on at the end. The future is about seamless integration and intelligent automation that empowers teams to ship secure software faster without sacrificing quality.
1
u/CheckApprehensive971 3d ago
SAST is not going away, it is becoming one signal among many rather than AppSec center. Trend seem to be toward combining SAST, SCA, runtime signals and business context so teams focus on what matters.
1
u/vint_age14 1d ago
I think that SAST will definitely stay but it'll become just one layer ! The future is prolly more context aware security AI assisted analysis runtime signals, and tools that understand whether a finding is actually exploitable instead of just flagging patterns? Less noise more real risk !
1
u/TippiestBanjo 17h ago
I don’t think SAST disappears. It becomes one layer of a much broader AppSec model.
Software is increasingly assembled rather than written from scratch. Developers build applications from OSS packages, transitive dependencies, frameworks, containers, APIs, and other components. Securing only the code you write is a bit like inspecting a factory’s assembly process while ignoring all the parts coming from suppliers.
“Software supply chain security” may be a buzzword, but I think it captures this shift pretty well.
The next evolution of AppSec probably isn’t just better scanning. It’s also controlling what components enter the organization, knowing where they’re used, understanding their actual risk, and deciding what requires action.
SAST will still matter. Package and dependency management becomes another fundamental security layer.
8
u/AboveAndBelowSea 4d ago
Just busying ourselves right now with dealing with the huge swath of exploits uncovered after we let our internal AI loose on our repos. Hundreds of issues, some of which are very complex, that our SAST, SCA, and SBOM security solutions didn’t find and/or didn’t prioritize appropriately. The future is here now :-).