Have you added any GenAI tools to your DevSecOps pipeline, or are you still worried about introducing security problems?

In my experience, adding GenAI tools to a DevSecOps pipeline can bring a lot of value in terms of efficiency and predictive capabilities. However, it requires a careful approach to mitigate the potential security risks.

We’ve been cautious in introducing GenAI to our pipeline, focusing on a controlled and gradual implementation. Our approach includes:

 • Rigorous testing in isolated environments to observe any security vulnerabilities GenAI might introduce.
 • Ensuring that we have human oversight in critical decision-making areas.
 • Leveraging GenAI primarily for tasks like vulnerability scanning and code review suggestions while maintaining a strong manual verification layer.

While the potential for security issues exists, proper guardrails and testing can minimize these risks, allowing us to harness the efficiency benefits GenAI brings.

Its not something that we have directly integrated yet, but we are experimenting with GenAI to see how it performs at identifying some of the more basic security risks.