Shifting Offensive Security Left: Rethinking DevSecOps in the Age of AI

Summary of “Shifting Offensive Security Left: Rethinking DevSecOps in the Age of AI”

Overview

This session from the GitHub Advanced Security series focuses on transforming offensive security practices by integrating AI-driven autonomous pentesting into DevSecOps workflows. It addresses the challenges of traditional pentesting, static and dynamic analysis, and the increasing complexity and speed of software development driven by AI-generated code.

---

Key Technological Concepts and Product Features

1. DevSecOps Gap & Challenges

• Traditional pentesting is expensive, slow, and often limited to critical applications, typically performed annually or quarterly.
• Static Application Security Testing (SAST), Software Composition Analysis (SCA), and secret scanning generate many alerts but have limitations:
  • SAST (e.g., GitHub’s CodeQL) identifies potential risks (CWEs) but often includes false positives/negatives and lacks exploitability validation.
  • SCA (e.g., Dependabot) accurately detects known vulnerabilities in third-party libraries but cannot confirm if those vulnerabilities are exercised in code.
  • Secret scanning struggles with evolving token patterns.
• Dynamic Analysis (DAST) and pentesting are resource-intensive and produce noisy results, making developer adoption difficult.
• The rise of AI accelerates both code creation and attacker capabilities, necessitating faster, scalable, and continuous security validation.

2. Expo Autonomous Pentesting Platform

• Expo is an AI-driven autonomous pentesting platform designed to scale offensive security by simulating a team of pentesters using AI agents.
• It performs continuous, autonomous, and comprehensive pentests on applications across staging or production environments.

Key features include:

• Agentic Architecture: Multiple AI agents coordinate to map applications, authenticate sessions (including MFA), discover endpoints (APIs, GraphQL), and perform targeted vulnerability exploitation.
• Exploit Validation: Uses deterministic validators (non-AI) to confirm if vulnerabilities reported by AI agents are real, reducing false positives and noise.
• Detailed Logging: Every agent action, request, and response is logged for transparency and auditability.
• Scalability: Runs hundreds of pentesting agents in parallel, enabling coverage across large portfolios and frequent testing (e.g., per release).
• Proof of Concept Generation: Provides developers with clear, reproducible exploit steps, improving understanding and remediation.

3. Integration with GitHub Advanced Security & GitHub Copilot

• Expo can ingest alerts from GitHub Advanced Security tools like CodeQL and Dependabot.
• It validates whether reported issues are truly exploitable by running targeted pentests.
• Once validated, Expo can automatically create GitHub issues for developers.
• GitHub Copilot coding agents can be assigned to these issues to automatically generate fixes and tests for vulnerabilities, accelerating remediation.
• Expo supports retesting post-fix to verify mitigations and ensure vulnerabilities are resolved.

4. Benefits and Impact

• Shifts offensive security left by enabling continuous, automated pentesting integrated into CI/CD pipelines.
• Reduces security debt by identifying and validating exploitable vulnerabilities early.
• Helps prioritize fixes by focusing on validated, impactful vulnerabilities rather than noisy alerts.
• Supports developers with actionable proof of concepts and automated fix generation, improving adoption and reducing friction.
• Acts as a force multiplier for human pentesters, allowing them to focus on complex, high-value assessments while Expo handles routine validation at scale.

5. Future Outlook

• Autonomous pentesting agents will increasingly fit into fast-paced CI/CD workflows, reducing the mean time to detect and fix vulnerabilities from weeks/months to minutes/hours.
• AI-generated code is becoming ubiquitous, necessitating scalable AI-driven security validation.
• The vision is a security ecosystem where validated exploitability is continuously assessed, fixes are automated, and security risks are minimized proactively.

---

Guides, Tutorials, and Demonstrations

• Demo of Expo Setup and Usage:

  • Setting up an Expo assessment by providing application URLs, credentials, and optionally source code or security artifacts.
  • Running autonomous pentesting agents to validate alerts from CodeQL and Dependabot.
  • Viewing detailed vulnerability reports with reproduction steps.
  • Creating GitHub issues from validated findings.
  • Using GitHub Copilot coding agents to automatically generate fixes and tests.
  • Retesting to verify fixes and close the vulnerability loop.

• Explanation of AI Agent Workflow:

  • Mapping and crawling the application.
  • Authentication handling.
  • Specialized pentesting agents targeting specific vulnerabilities (e.g., remote code execution).
  • Validation of AI findings using deterministic code to avoid hallucinations.
  • Logging and transparency for security teams.

• Discussion on Pentesting Frequency and Challenges:

  • Typical pentesting cadence (annually or quarterly).
  • Limitations of traditional pentesting and dynamic analysis tools.
  • How Expo addresses scalability and noise issues.

---

Main Speakers / Sources

• Lupita Graves: Application Security Executive at GitHub; provides industry context and overview of DevSecOps challenges and AI impact.
• Matthew (Last name not provided): Field Engineer/Specialist at Expo; presents Expo platform features, demos, and integration with GitHub.
• Alvaro (Last name not provided): Security Researcher at Expo; explains technical details of Expo’s AI agent architecture, validation process, and pentesting workflow.
• Anna: Producer and event planner for the session; moderates and introduces speakers.

---

Summary

This session highlights the evolution of DevSecOps security practices by leveraging AI-powered autonomous pentesting (Expo) integrated with GitHub Advanced Security and GitHub Copilot. It addresses the limitations of traditional pentesting and static/dynamic analysis by providing continuous, scalable, and validated offensive security testing that fits modern CI/CD pipelines. The approach enhances developer experience, reduces noise, prioritizes real vulnerabilities, automates fixes, and accelerates remediation—ultimately aiming to shift security left in the age of AI-driven software development.