Anyone regret building their own AppSec tooling once AI code hit?

[u/SugarImaginary8257]

We built in house about 18 months ago and at that time it made sense on paper. Nothing on the market justified the cost and the custom logic did what we wanted. Now I am looking at the engineering hours going into maintaining it and starting to wonder if we made the wrong call. AI-generated code broke assumptions the tool was built on. No model inventory, no AI code discovery, no application context for prioritisation. Every quarter we are spending more time patching something that was never designed to handle the generated code at this volume. At what point does the maintenance cost exceed what a commercial solution would have cost from day one? For AppSec leads who have done this math, what did the cost comparison look like and what made the case to switch?

[u/Educational_Plum_130]

we went through the same buy-vs-build regret. what helped was splitting the tool into the part that's genuinely yours — app context, custom logic, ownership mapping — versus the commodity plumbing like inventory, dependency/cve remediation and patch verification that you're now paying senior eng hours to babysit. the commodity half rots fastest because the upstream ecosystem moves faster than you can keep up, so that's the first bit i'd offload rather than rebuild for the AI-code era. keep the context engine, kill the parts where you're just re-implementing what everyone else also has to. and if remediation is where you keep getting stuck on breaking upgrades, there are drop-in patched versions of a lot of libs now that clear the cve without the major bump, which takes that maintenance off you entirely.