May 2026 Summaries

AI has significantly transformed the software development lifecycle, particularly the early phases such as planning, design, and implementation, through tools like Claude Code and Codex, which expedite coding processes. While these AI-driven coding agents have enhanced the speed of feature writing and deployment, the later phases like testing and security have not kept pace, resulting in a heightened risk of vulnerabilities due to the increased volume of AI-generated code. The traditional approach of conducting security tests during the CI/CD phase is now insufficient, as rapid AI-driven iterations mean developers have often moved on by the time vulnerabilities are identified. To address this, security testing must occur in real-time during development, within the AI agent's workflow, allowing immediate identification and resolution of issues before code is committed, thereby preventing vulnerabilities from entering production. This shift not only aligns security with the accelerated pace of AI-driven development but also reduces the potential for backlog and ensures vulnerabilities are remedied before they pose a risk, demonstrating a scalable solution to application security in the age of AI.

Hagerty successfully scaled the security tool StackHawk across over 40 developer teams within two quarters by emphasizing project management and coordination over technical challenges. Led by John Mercer, a DevOps Security Engineer, the rollout focused on gaining leadership and developer buy-in, leveraging existing goodwill between Security and Engineering, and utilizing strong project management to prioritize and integrate StackHawk into development cycles. By establishing repeatable patterns and clear communication of the tool's value, particularly its ability to simulate real-world attacks without causing pipeline bottlenecks, Hagerty managed to operationalize application security effectively. The approach highlights the importance of distributed ownership and clear communication in scaling application security, demonstrating that with the right strategy, tools like StackHawk can be integrated smoothly across large teams, ensuring that security does not become a development bottleneck.