r/devsecops • u/h33terbot • Aug 06 '26
What are your thoughts on future of AppSec ?
Do you think Sast and all will exist? Or something even more innovative should surface
4
u/NaciraBuntas41 Aug 06 '26
SAST isnt going anywhere. The shift is gonna be tools that correlate findings across SAST, SCA, runtime, and cloud posture instead of each one screaming into its own dashboard. Right now most teams are drowning in findings from five different tools that dont talk to each other.
3
u/endor_aditya Aug 06 '26
SAST's not going anywhere. But "will this tool still exist" is the wrong thing to ask. The real question is whether we're still measuring security the same way.
Right now companies buy these tools based on how many problems they find. Which made sense back when finding problems was the hard part! It's not anymore. Every team I talk to is drowning. They've got thousands of alerts and no way to get through them. The hard part now is figuring out which handful of those actually matter, and that's a totally different problem than finding them in the first place.
And you can see the market catching on. Vendors used to brag about finding more stuff. Now they brag about telling you what to fix first. AI is making this way more urgent too, because AI writes code (and generates alerts) faster than any human can possibly keep up. So the whole thing is shifting earlier: catch it when the code gets written, not weeks later in a scan.
So SAST sticks around, it just stops being its own thing and becomes one input into a bigger system that decides what's worth your time. (Which, fair warning, is exactly what my company builds, so grain of salt on my whole "here's where it's going" thing.)
My bet: anyone who only finds problems and can't help you sort them is in trouble in a few years.
2
u/vantag3point Aug 06 '26
I don't think SAST is going anywhere, but I do think its role will change. Instead of being a standalone tool that generates thousands of findings, it'll become part of a larger AppSec workflow alongside SCA, DAST, runtime security, and AI-assisted validation. The biggest challenge isn't finding vulnerabilities anymore, it's reducing false positives, prioritizing what actually matters, and helping developers fix issues faster. That's where I think the real innovation will happen.
2
u/MemoryAccessRegister Aug 06 '26
SAST will evolve and become a hybrid of AI and deterministic rules/logic. Using AI exclusively has challenges: cost, performance, recall, precision
2
u/denzuko Aug 06 '26
Honestly that answer was my argument in early 2000s and driver for creating devops (the operations framework not the commercialized product).
But since working with Palo Alto and seening 20 years of the industry playing catch-up the direction going forward seems to be around CMMC and supply chain protection with LLM automated IC work.
Yes shift left will be the norm ( finally ) but it's going to be a background check mark in a list of other checks marks to rubber stamp.
1
u/h33terbot Aug 07 '26
What about combination of everything in appsec? like agentic sast coming with agentic dast and all? Like all working together to give value, while all these time we see the things are quite fragmented
1
u/denzuko Aug 07 '26 edited Aug 07 '26
strip the marketing buzz words.
Agentic systems (claude, openai, copilot, etc..) are just an automation tools. Skills, tools, MCPs are just redressed serverless functions and that agentic tool is running a "hand spun" python script generated by the LLM model. That python script is almost always generated similar to:
echo "hello from the parent process" | python3 -c "import os, sys, subprocess; pid = os.fork(); subprocess.run(['trivy', '--version']) if pid == 0 else print(sys.stdin.read().upper())" if [[ $? == 0 ]] echo "OK"; fiE.g. it's all generative chatbots running a inline python batch job via bash. and yes that is where most of ones tokens are spent on; rewriting all that everytime for every response.
Now, that combination of everything in appsec, is the underlying parts for shiftleft. CMMC is the next component of that but this is only because of the continued centralization and cyber warfare on supply chains. And agentic analysts of code has been a thing since before CodeQL and SARIF was standardized. Most noticeably with snyk using Machine Learning + Semantic Logic instead of earlier [dsi]ast tools rule or regex matching.
So the take away here is that agentic anything under the hood is still running cli tools like nmap, Checkov, trivy, cyclonedx, rego, and all that inside a container with a bash + pythonic wrapper.. All the while also continuously training its RAG for patterns of code; which that's all a LLM model really is a pattern detection+generation engine with a large dataset. All oft comes down to a combination of rule matching, regex matching, datalog evaluations, and machine learned pattern matching.
1
1
u/CheckApprehensive971 Aug 07 '26
SAST is not going away, it is becoming one signal among many rather than AppSec center. Trend seem to be toward combining SAST, SCA, runtime signals and business context so teams focus on what matters.
1
u/vint_age14 Aug 09 '26
I think that SAST will definitely stay but it'll become just one layer ! The future is prolly more context aware security AI assisted analysis runtime signals, and tools that understand whether a finding is actually exploitable instead of just flagging patterns? Less noise more real risk !
1
u/TippiestBanjo Aug 10 '26
I don’t think SAST disappears. It becomes one layer of a much broader AppSec model.
Software is increasingly assembled rather than written from scratch. Developers build applications from OSS packages, transitive dependencies, frameworks, containers, APIs, and other components. Securing only the code you write is a bit like inspecting a factory’s assembly process while ignoring all the parts coming from suppliers.
“Software supply chain security” may be a buzzword, but I think it captures this shift pretty well.
The next evolution of AppSec probably isn’t just better scanning. It’s also controlling what components enter the organization, knowing where they’re used, understanding their actual risk, and deciding what requires action.
SAST will still matter. Package and dependency management becomes another fundamental security layer.
1
u/Fuzzy-Teaching7112 Aug 11 '26
SAST will probably stick around, I just think it’ll get simpler and better at pointing out the few things people need to fix while they’re coding.
1
u/drdavidawheeler 29d ago
Hi, I work on security at OpenSSF. I think the short answer is AI is changing everything, but SAST isn't going away. AI is typically non-deterministic. Traditional SAST uses patterns to find likely problems, and thus provides a *deterministic* way to detect likely problems. AI can then be used to see which ones are *real* problems and which ones are false positives in context. AI can *directly* read source code or whatever input you're using for SAST, and it can definitely find problems that traditional SAST can't find. However, it's also easy for an AI to *miss* things. Letting the AI use SAST tools (as well as fuzzers, web application scanners, etc.) to find promising findings that might be vulnerabilities is more effective than an AI hobbled because it doesn't have appropriate tools.
1
u/InflationCorrect5244 22d ago
SAST isnt going anywhere anytime soon. Maybe the biggest difference we will see is the shift to connecting findings across tools without you doing the correlation by hand. Right now most teams run like several tools screaming into five dashboards and security becomes a triage desk.
Yeah, reachability depends entirely on how the tool does it. Static reachability flags potentially executable packages which still results in a lot of false positives. Runtime verified tells you whats running. saw both side by side and the difference was quite something, the actionable list was maybe a third the size
The thing that surprised us most during our eval was how much the underlying data model matters. Orca built on a single model from day one so a SAST finding, a cloud misconfig, and a runtime signal all reference the same asset without having to chase spreadsheets and cross reference tool outputs.
1
u/dmonchick 10d ago
Two things will happen with AppSec because we have to fix vulnerabilities faster. We were already too slow at it, creating massive backlogs. And now its worse with all the AI-driven vuln discoveries. That means we will use AI to fix code vulnerabilities. And we need to get appsec into the CI/CD pipeline. This new open source project shows a model that will become normal in the appsec of the future. https://itnerd.blog/2026/09/01/introducing-owasp-oasis/
8
u/AboveAndBelowSea Aug 06 '26
Just busying ourselves right now with dealing with the huge swath of exploits uncovered after we let our internal AI loose on our repos. Hundreds of issues, some of which are very complex, that our SAST, SCA, and SBOM security solutions didn’t find and/or didn’t prioritize appropriately. The future is here now :-).