# Xavier René-Corail: how AI is changing the "shift left" mindset Source: https://www.youtube.com/watch?v=sJjISI3Li4I Recap page: https://rapidrecap.app/video/sJjISI3Li4I Generated: 2026-03-03T16:34:59.018+00:00 --- ## Quick Overview The future of "secure by default" in the age of AI involves shifting security left into the development workflow, utilizing AI assistants to suggest security fixes contextually during coding, and improving the signal-to-noise ratio of alerts so developers remain confident and efficient. **Key Points:** - AI presents an opportunity to dramatically increase productivity for developers fixing security vulnerabilities, moving from theory to applied practice. - AI helps close the security knowledge gap in the software development population by providing context-aware fixes directly where code is written. - GitHub's security researcher emphasizes that fixing vulnerabilities is often more time-consuming than the initial coding itself, highlighting the need for acceleration. - A major risk introduced by AI is that developers may become less knowledgeable about security fundamentals (like authentication/authorization) because AI tools handle the fixes. - The ideal future state is moving security left, where AI assistants suggest fixes directly in the IDE, ensuring security knowledge is applied immediately. - Broken Access Control is currently the top vulnerability because authentication and authorization are inherently difficult to get right, even for experienced developers. - The most important security habit developers should adopt today is code review, as it forces better human understanding of security context, which AI cannot fully replace. ![Screenshot at 00:15: Xavier René-Corail, Senior Director, Security Research, GitHub, is introduced while discussing how AI can accelerate fix times for security vulnerabilities, representing the core focus of the interview.](https://ss.rapidrecap.app/screens/sJjISI3Li4I/00-00-15.jpg) **Context:** Xavier René-Corail, Senior Director of Security Research at GitHub, discusses the evolving landscape of software security, particularly how Artificial Intelligence (AI) is impacting developer workflows and the concept of being "secure by default." He contrasts the previous reliance on post-facto security knowledge and alerts with the new paradigm where AI tools actively integrate security guidance directly into the development process. ## Detailed Analysis Xavier René-Corail explains that AI offers a significant productivity gain in addressing security vulnerabilities by enabling developers to transition from theoretical security knowledge to practical application directly within their workflow. He notes that fixing vulnerabilities often consumes more time than writing the initial code, making AI acceleration vital. A key challenge AI introduces is the potential erosion of developer security knowledge; if AI assistants consistently provide fixes for complex issues like authentication and authorization (which he notes is the top vulnerability, Broken Access Control), developers might become overly reliant and less capable of understanding the underlying security principles. The goal is to use AI to bring security knowledge earlier into the process, suggesting fixes contextually during coding rather than relying on noisy, post-facto alerts. René-Corail advocates for a shift left approach, where AI tools suggest fixes directly in the IDE, ensuring the code generated is secure by default. He stresses that while AI code generation is growing, it should complement, not replace, human expertise, particularly in code review, which remains the most critical habit for ensuring developers retain security understanding. ### AI and Productivity Gains - AI offers a big productivity gain for developers fixing security vulnerabilities by enabling the shift from theory to applied practice - AI accelerates fixing security vulnerabilities, which often takes more time than the original coding. ### Security Knowledge Gaps and AI Risk - There was a security knowledge gap in the development population, often relying on post-facto security alerts - AI assistants risk making developers less knowledgeable about security fundamentals like authentication/authorization. ### Broken Access Control as Top Vulnerability - Broken Access Control is the top vulnerability because authentication and authorization are difficult to implement correctly, even for experts. ### The Future of Secure by Default - The future involves AI assistants suggesting security fixes contextually during coding, running security tools in the background, and generating code that is as secure by default as possible. ### The Most Important Security Habit - The single most important security habit developers should adopt today is code review, as it forces better human understanding of security context, which AI cannot fully replicate. ![Screenshot at 00:03: Title slide introducing the topic: "GitHub security researcher on developments in security in the age of AI"](https://ss.rapidrecap.app/screens/sJjISI3Li4I/00-00-03.jpg) ![Screenshot at 00:12: Title slide asking how AI accelerates fix times: "How is AI helping to accelerate fix times?"](https://ss.rapidrecap.app/screens/sJjISI3Li4I/00-00-12.jpg) ![Screenshot at 01:32: Title slide asking about security automation adoption: "How are developers embracing security automation with Dependabot?"](https://ss.rapidrecap.app/screens/sJjISI3Li4I/00-01-32.jpg) ![Screenshot at 02:13: Title slide posing a question about Broken Access Control ranking: "Why is Broken Access Control now the top vulnerability?"](https://ss.rapidrecap.app/screens/sJjISI3Li4I/00-02-13.jpg) ![Screenshot at 02:52: Title slide asking about the most important developer security habit: "What's the most important security habit developers should adopt today?"](https://ss.rapidrecap.app/screens/sJjISI3Li4I/00-02-52.jpg)