Building security into software delivery

Every vulnerability that reaches production was cheaper to fix at some earlier point, and cheapest of all at the keyboard where it was written. That arithmetic is the whole case for building security into software delivery rather than inspecting it in afterwards — and it has just been sharpened by a new fact: an increasing share of the code was not written at a keyboard at all. This playbook covers the pipeline disciplines, and what changes when the author is a model. 1. Scan where the work happens Four kinds of defect want catching before merge, not after deployment. The code itself — the injection flaw, the broken access check. The dependencies — the open-source components that are most of every modern application, each carrying its own history. The secrets — credentials committed in a hurry, which become identity incidents the moment the repository is wider than intended. And the infrastructure definitions — the misconfigured bucket or over-permissive role, now expressed as code and therefore checkable as code. Wire all four into the pipeline so every change is examined on the way in, automatically, every time. 2. Prioritise by risk, not by count Turn every scanner on and the first result is a number in the thousands — and a security queue nobody will ever clear. The program lives or dies on triage: which findings are in code that actually runs, reachable from an input an attacker controls, on an asset that matters? A short list ranked by exploitability gets fixed; a long list ranked by severity label gets a dashboard. Measure the program by risk retired — critical findings fixed, time-to-fix trending down — never by findings produced, which rewards noise. 3. Keep developers in flow Security that interrupts gets bypassed; security that fits the workflow compounds. Findings surface in the tools engineers already inhabit — the editor, the pull request — with the fix suggested where possible, not filed as a ticket to a queue in another team's system. The pull request is the natural gate: block on the few classes that must never merge, advise on the rest, and keep the feedback fast enough that waiting for it never becomes the reason to work around it. Every workaround is a policy failure, not a people failure. 4. AI writes code faster than review reads it Assisted development multiplies output — of good code and of plausible-looking vulnerable code alike, delivered with a confidence that invites rubber-stamping. The response is not prohibition; it is holding the gates. Generated code enters through the same pull request, meets the same scanners, and gets the same review — with reviewers taught the specific failure modes of generated code: invented dependencies, subtly wrong authorisation logic, patterns copied from a training corpus that never saw your threat model. The pipeline that already treats every change with suspicion barely notices the new author. That is the point of having one. 5. The obligations dividend A pipeline that scans, gates, and records does the compliance work as a by-product: the evidence of secure development practice that CPS 234 implies and every security questionnaire asks for is the pipeline's own log. Assurance by extraction — screenshots and attestations assembled annually — costs more and proves less than a delivery system that enforces the standard on every merge. 6. The first 90 days Turn on dependency and secrets scanning first — highest signal, least noise. Add code and infrastructure scanning gated on new findings only, so the legacy backlog does not bury the program on day one. Publish the triage rule and the two metrics that matter: critical time-to-fix, and gate-bypass count, which should be zero. Then sample the AI-assisted changes merged last quarter and review them cold — the result sets the training agenda, and occasionally the incident response one. The delivery pipeline is where the organisation's intentions about security become enforceable. Everything upstream is culture; everything downstream is response. The pipeline is where it is cheap.