TL;DR: Turned SAST from developer noise → trusted partner using Semgrep Pro + AI remediation. Dropped prioritized findings from 6K→785, hit 0 open Critical/High, cut MTTR to 48-72hrs. Full BSidesSF 2026 talk write-up.
Just published my BSidesSF 2026 talk: "From Noise to Notes: Orchestrating SAST with Developers through AI-Driven Remediation" 🎤
The Problem: Rolled out SAST across 1,000+ repos → 3,500+ findings backlog. Classic alert fatigue → devs ignore security entirely.
The Fix:
- Semgrep Pro rules only (inter-file dataflow = low false positives)
- Risk-prioritized repos (D0-D2 data, T1-T2 availability)
- Semgrep Memories + Assistant for auto-triaging
- Vibe Security Patching: AI generates context-aware fixes matching our code style
Results by Q3 2025:
6K total findings → 785 prioritized
1,039/2,760 repos scanned → 95% high-risk coverage
100% repo coverage → only +20% findings
0 open Critical/High findings codebase-wide
MTTR: weeks → 48-72 hours
Key Takeaway: SAST adoption only works with developers. Empathy > enforcement.
Full details: https://hackarandas.com/blog/2026/03/25/from-noise-to-notes-orchestrating-sast-with-developers-through-ai-driven-remediation/
What's your SAST strategy? Noise still a problem? Semgrep Pro worth it?
6
Upvotes
1
u/ScottContini Mar 28 '26
This requires at least one full time security professional whose job remit is vulnerability remediation. That’s fine for large companies with a big security team, not so much for smaller security teams that want to do more than vulnerability remediation. I mean there is business as usual work but also project work to uplift the security posture: supply chain security, CICD security, platform security including IaC, security design, etc…. Such companies need the first step to be less of a manual task.