From periodic security review to every commit

Most teams still run security review at major releases or when a certification needs one. Coding agents now ship code every day, and security capacity hasn’t grown with them, so most of what ships goes out with no security review at all.

We changed that in our own delivery work: security starts in the spec, before any code exists, and a check runs on every pull request. In the demo, a one-line ticket about paying out a gift pool became a full list of security requirements and abuse cases before anyone wrote code.

In our AI for tech teams webinar on 14 October, Babatunde Yakub and I ran the whole process live on Jarful, a small fictional app where friends pool money for a gift:

• a security spec skill that turns a ticket into security requirements and abuse cases;
• a threat model skill that maps trust boundaries and where personal data and bank details live;
• a review on every pull request, checked against the spec and the threat model;
• a full codebase scan, where investigator agents look for issues and refuter agents check whether each finding is real.

It’s for CTOs, engineering leaders and security leads whose teams already use coding agents, or will soon.

Check the slides of the webinar here!