Machine-Speed Security for the Software Factory Era
How AI is reshaping software security from detection to remediation
1The new security bottleneck
With code no longer being the constraint in software development, trust has become the scarce resource. GitLab's CISO highlights that detection alone isn't defense - security must be embedded throughout the development pipeline. The key metric shifts from scan counts to time between detection and verified remediation. This change reflects how AI models are compressing attack timelines, making traditional security approaches obsolete.
2Explosion in vulnerabilities
GitLab's data shows a dramatic increase in security issues - 317 CVEs published in 2026 compared to 181 in 2025. The bug bounty program received 3,600 reports in 90 days versus 1,440 for all of 2024. This isn't unique to GitLab; NIST stopped enriching most CVEs due to volume, and Verizon's report shows vulnerabilities surpassing credential abuse as the top attack vector for the first time in 19 years.
3AI's dual-edged impact
While AI models help attackers find and exploit vulnerabilities faster, they also empower defenders. Security teams can leverage the same models to scan their own systems proactively. GitLab collaborates with Anthropic on Project Glasswing, using advanced models across critical systems and repeating scans as models improve. The company serves as 'customer zero' for its own security standards.
4Three-layer defense framework
GitLab proposes a machine-speed security model with three layers: 1) Continuous discovery of vulnerabilities across code, infrastructure and deployment paths. 2) Strengthening foundations through secrets management, policy enforcement and agent governance. 3) Protecting shipped software through ongoing scanning and remediation in developer workflows. Each layer must scale with increasing code volume and model capability.
5Agent identity crisis
As AI agents produce more code, organizations face a shadow software factory problem. Unmanaged agents operating outside governed pipelines create security blind spots. GitLab's solution requires giving agents explicit identities, minimum permissions, and auditable actions. High-risk operations need attributable approval boundaries, especially as agents gain access to repositories, CI/CD systems and cloud infrastructure.
6Policy in the execution path
Effective security requires embedding controls where work happens. GitLab implements scanning where developers work, converges findings in one system, and uses agents to generate tested fixes. Secrets become short-lived and revocable by default. The platform enforces that if the pipeline can't prove security compliance, it won't ship the code - creating a closed-loop remediation system.
7From 1% to 97% coverage
GitLab's automation demonstrates the scale possible with agentic security. Where human review previously covered 1% of merge requests, agents now review 97%. This 100x improvement in coverage was unimaginable a year ago but is now the expectation. The platform combines source control, security, CI/CD and merge approvals into a single governed workflow.
8The remediation metric
Time from detection to verified remediation becomes the critical security KPI in an AI-driven landscape. GitLab segments this metric by severity and attack path to drive continuous improvement. The approach recognizes that discovery without fast remediation just grows inventory - real security requires closing the loop at machine speed.
9Peer validation
Industry CISOs confirm this operational shift. Cloud Security Alliance's AI CISO emphasizes governed remediation loops. Workday's CISO stresses lawful agent rails with explicit identities. Zscaler's CSO highlights continuous hardening of development platforms. All agree that traditional security models can't keep pace with agentic development without architectural changes.
10Shadow factory risk
The unmanaged 'shadow software factory' - where agents operate outside governed systems - represents a major architectural risk. These parallel pipelines lack records of how code was made, what tools were used, or what permissions were granted. Security teams get artifacts after the fact rather than governing the development process itself.
11Operational questions
Effective security programs must answer: What's our complete attack surface and when was it last scanned? Which findings are real versus false positives? How long are vulnerabilities exposed before verified fixes? These operational metrics determine whether security keeps pace with AI-driven development and threats.
12The governance imperative
The transition to machine-speed security requires rebuilding development pipelines with governance at their core. GitLab's approach shows how to combine agent capabilities with human oversight at scale. Organizations that fail to architect their software factories for this new reality risk being overwhelmed by the volume and speed of modern threats.
Original article: GitLab — Machine-Speed Security for the Software Factory Era