Why Tool Sprawl and Late-Stage Security Audits Kill Velocity

▶ Watch (07:19)

Cathay Pacific runs 1,000-plus business applications across 100-plus destinations, moving 2 million passengers a month. Before the transformation, developers juggled separate tools for every function, and security was someone else’s problem. Vulnerabilities surfaced only when the security team reviewed code before a release, triggering firefights between developers, security, and the business over who had to fix what and when.

That late-stage model had a direct cost: team morale dropped, timelines slipped, and business delivery stalled. Cathay needed a different approach, one where agility and security were solved together rather than traded against each other.

Evaluating and Rolling Out GitHub Copilot Across 1,000 Developers

▶ Watch (13:34)

Cathay tested GitHub Copilot against other tools across Java, JavaScript, Python, Kotlin, and .NET before committing. After a structured pilot with defined acceptance criteria:

“the clear winner is GitHub Copilot.” — Naveen Jaisankar

Rollout went in phases with workshops for close to 1,000 developers and continuous retraining as new features shipped. Three problems followed: low initial adoption, hallucinations producing tidy but wrong code, and shadow AI creating compliance gaps. Cathay countered with Atlassian integrations for richer IDE context, a zero-trust ban on unauthorized tools, and a governance board to approve use cases. Active usage now sits above 90% among more than 600 developers.

Embedding DevSecOps Without Slowing the Development Team

▶ Watch (19:40)

Tools were in place when DevSecOps rolled out. Developers weren’t acting on findings. Alert fatigue was the culprit: SAST, DAST, IAST, secret scanning, and container scanning produced overlapping noise that buried real issues. PCI DSS version 4 mandates most of those scans, so cutting tools was not an option.

Cathay deduplicated findings under GitHub Advanced Security and added guardrails blocking critical or high-severity vulnerabilities before production. A hundred developers received security training and now sit in the approval workflow, reviewing false positives daily.

“DevSecOps is not about just the tool adoption,” — Naveen Jaisankar

All 2,500 microservices run this flow today.

Measured Outcomes and the Road to Agentic AI

▶ Watch (24:15)

Code acceptance rate is up. Year-on-year security fix rates have improved, driven by AI-assisted remediation inside the developer workflow. Cathay’s next target is higher acceptance rates still, using Agent HQ and agentic operating models to reduce boilerplate and push more of the SDLC to automated agents.

The roadmap also pushes shift-left past the engineering team. Low-code and no-code platforms are putting application development into the hands of business teams. Rajiv’s condition: guardrails covering security, data governance, and compliance must come first. When those are in place, the business can own delivery directly, and IT stops being the bottleneck.

Q&A

What’s next in terms of AI and developer teams at Cathay? Naveen said they will deepen AI integration across the SDLC, bring more context into the IDE, and move toward agentic operating models using Agent HQ to improve code acceptance rates further. ▶ 27:48

How do you see AI helping developer teams translate into business impact? Rajiv said the shift-left model will extend to the business itself via low-code and no-code platforms, with guardrails for security, data governance, and compliance as a prerequisite before handing delivery ownership to business teams. ▶ 28:36

Notable Quotes

the clear winner is GitHub Copilot. Naveen Jaisankar · ▶ 14:38

we have banned all the shadow AI’s, Naveen Jaisankar · ▶ 18:07

DevSecOps is not about just the tool adoption, Naveen Jaisankar · ▶ 22:03

Key Takeaways

  • Piloting Copilot across Java, JavaScript, Python, Kotlin, and .NET before full rollout cut resistance and drove 90% active usage among 600-plus developers.
  • Unifying AppSec tools under GitHub Advanced Security and deduplicating alerts let developers focus on real vulnerabilities, not noise.
  • Training 100 developers as security reviewers embedded security ownership into daily workflow rather than leaving it to a separate team.