AI
Three Systemic Failures Driving Breach Risk
Research shows 60% of vulnerabilities go undetected. Roughly 50% of findings at companies Sadeddin works with are false positives. Developers spin their wheels trying to fix what turn out to be false alarms. The combination produces a broken relationship between AppSec and development. The average breach costs $10 million, and fixing something in production can run into the tens of thousands. Noncompliance costs are rising as regulation gains teeth, including the EU Cyber Resilience Act.
Why Pattern Matching Misses the Hardest Bugs
Most scanners use regex and keyword-based rules. Poorly written rules mean poorly written code slips through. The deeper problem is context. Sadeddin showed a four-line logout function with no session expiration: 80% of developers who saw it on LinkedIn missed the flaw. He showed a Ruby users controller that lets users update passwords with no minimum requirements. Neither flaw is detectable by pattern matching because there is nothing to match. The missing lines are the vulnerability.
False Positives and the Cyclone of Debate
Scanner companies over-report because security teams historically rewarded whoever found the most findings during POCs. Sadeddin calls this the “cyclone of debate”: the scanner flags something, the developer calls false positive, and half-hour meetings consume everyone. He puts the false positive rate at 30-50%, citing one JavaScript/TypeScript dev manager who saw 45% false positives. Someone has to absorb the load. He names three options: the security team triages everything, the dev team takes the hit, or security hygiene quietly collapses.
The Fix Problem: 40 Permutations Per Vulnerability
Knowing the concept of SQL injection remediation and actually fixing it are different problems. There are over 40 permutations: language, framework, and database connector all change the answer. A Django app with a raw query should use the native ORM. A Python app without an ORM needs a different approach. A C app needs a different solution again. Developers working across three to five languages face potentially 50 to 100 variations of OWASP Top 10 fixes per year. Most end up on Stack Overflow or ChatGPT mapping the generic fix to their specific context.
Developer Experience Is a UI/UX Problem
Shift left fails because it is designed by security teams without developers in mind. Sadeddin argues developer experience is a UI/UX problem: when his team interviewed developers, they split across IDE plugins, CLI, web app, and pull request timing. Forcing one channel kills adoption. The terminology makes it worse. A Hacker News commenter called SAST “a fancy Enterprise term for a security linter.” Developers already use linters. Framing security tooling as a code quality linter gets adoption. Explaining it as “static application security testing” does not.
Q&A
If tooling only detects, not prevents, how do you move toward avoidance? Excellence requires paved roads and secure-by-design architecture backed by real CTO-security alignment, but the talk targets the baseline: getting CWE-class flaws found and fixed before breach. ▶ Watch (32:56)
What are low-hanging-fruit tactics for making shift left less painful? Change how you talk to developers first, then run focused campaigns targeting one vulnerability class at a time rather than the full backlog. ▶ Watch (38:58)
Can AI reduce false positives from existing scanners? Corgea connects to existing SAST tools and cuts false positives by roughly 30% today; LLMs handle context synthesis across multiple languages without needing the language-conversion layers that code property graphs require. ▶ Watch (43:44)
When library vulnerabilities keep reappearing and management demands zero, what works? A risk-based approach with reachability tools filters unexploitable code paths; archiving chronic non-issues with a quarterly review note satisfied both auditors and developers in one audience member’s experience. ▶ Watch (1:00:28)
Notable Quotes
context is everything Ahmad Sadeddin · ▶ Watch (5:08)
in their eyes it’s better to over report Ahmad Sadeddin · ▶ Watch (16:39)
in reality there’s 40 different ways to Ahmad Sadeddin · ▶ Watch (23:29)
I am become a human SAS Ahmad Sadeddin · ▶ Watch (36:16)
Key Takeaways
- Pattern-based SAST misses context-dependent vulnerabilities like missing session expiration or absent password requirements.
- False positives at 30-50% create a cyclone of debate between security teams and developers, eroding trust over time.
- SQL injection has 40-plus fix permutations by language, framework, and database connector, making developer remediation difficult.
- Developer experience is a UI/UX problem: security tooling adoption depends on meeting developers in their existing workflow.
- LLMs reduce false positives by roughly 30% by understanding code context across multiple languages and frameworks.
About the Speaker
Ahmad Sadeddin is a three-time founder with one exit and currently serves as CEO at Corgea. He led multiple products at Coupa for over six years following their acquisition of his previous startup, Riskopy. Corgea grew out of his frustration with the manual, inefficient processes companies use around security.