AI
The Script Problem That Never Got Solved
Software engineering moved from manual deploys to tested, observable pipelines. Security engineering did not. At startup scale, mid-scale, and enterprise scale alike, the pattern is the same: scripts on different servers, glued together, with no ownership and no alerting. Silent failures go undetected. When an auditor asks what was running and when, there is no answer. Aseem Shrey built security from scratch at companies that became decacorns and watched this repeat every time.
Why Scripts Fail at Scale
Tool sprawl compounds the script problem. Teams buy a separate vendor tool for code scanning, PR scanning, cloud security, and CI/CD security, then negotiate multiple contracts every year. Open-source tools get abandoned because nobody wants to own the operational risk. Security engineers are strong problem solvers but are not, by default, strong developers. A script that handles one AWS account breaks when you need it across 5,000 GCP projects, with queryable logs a year later.
Ship Studio: Containerized Workflows With a Drag-and-Drop Builder
Ship Studio replaces scripts with a visual canvas. Each security tool, Nmap, Prowler, Trivy, Gitleaks, exists as a versioned Docker component. You drag components onto the canvas, wire their input and output ports, and save. The backend uses Temporal, the same workflow engine Snapchat and Uber run in production, which provides retries and fault tolerance. Workers run on Kubernetes. ClickHouse stores all run data and Kafka handles event streaming, so every execution is logged and queryable from the UI.
Live Demo: CSPM Workflow on AWS
The demo opened the minimal CSPM workflow, which chains an AWS credential builder to a versioned Prowler container. Triggering the workflow via webhook or cron kicks Prowler against a real AWS account. Logs stream live to the platform. Every canvas save creates a new version: moving a node from version 5 to version 6. That version history means an auditor can see the exact workflow configuration that produced a specific scan result. A second pre-built workflow chains OpenGrep, TruffleHog, a dependency scanner, and an OpenCode AI agent that comments on pull requests.
Use Cases: In-House Products and a Workflow Marketplace
Reusable workflows run on any target: an EC2 instance, a Kubernetes cluster, or anything else. A small company without a security budget can pull Ship Studio, load three or four community workflows, and get continuous cloud scanning and PR code review without writing a line of Python. Aseem described building the same workflows manually at every organization he joined and said a public marketplace would let security engineers share that work instead of rebuilding it each time.
Q&A
Can the platform trigger workflows from an existing CI/CD pipeline rather than replacing it? You can add a step in your CI/CD that fires a webhook to trigger the workflow; results still land on the Ship Studio dashboard as the central record. ▶ 24:44
Does the tool handle finding lifecycle management and routing findings to the right team? A management component lets you route vulnerabilities to the correct owner or mark them as false positives. ▶ 25:35
Notable Quotes
scripts don’t scale. So something that you have written that works for your organization for a single AWS or or let’s say a couple of orgs that’s good something you can run locally but when you have to scale it up when you have to ensure that artifacts are maintained logs are being created and all the output is being stored and queryable even after let’s say a year from now that’s when the problems start to show up. Aseem Shrey · ▶ 08:06
every company automates security but few operate those automations like software Nancy Chauhan · ▶ 05:37
security engineers they are very good problem solvers. If you ask them how to do a attack surface management or how to do cloud security, they would have 10 different ideas and all of them would be really good but they are not necessarily good developers. Aseem Shrey · ▶ 07:30
Key Takeaways
- Security automation at every company size still runs on fragile, unobservable scripts.
- Ship Studio wraps Docker components in Temporal-backed workflows, adding retries, versioned audit history, and streamed logs.
- Teams can share complete workflows instead of Python scripts, removing the need for multiple vendor contracts.
About the Speaker(s)
Nancy Chauhan is a Developer Advocate and Engineer focused on software reliability across cloud-native and open-source environments. She has contributed to the Kubernetes release team, led TAG Environment Sustainability at CNCF, and founded the Women in Cloud Native community. She currently works at Arise AI on LLM observability and AI agent evaluations.
Aseem Shrey spent seven years as a security engineer at companies including Rippling, Yahoo, and Gojek, building security programs from scratch at startups that later became decacorns. He co-founded ShipSec.ai to turn those hard-won workflows into a reusable, open-source platform, and teaches cybersecurity on his YouTube channel.