AI-Augmented DevSecOps Pipelines: Enabling Continuous Security Integration in Large-Scale Software System

Abstract

This paper proposes an AI-augmented DevSecOps pipeline that embeds continuous security controls across the software lifecycle plan, code, build, test, release, deploy, and operate for large-scale, polyglot systems. The architecture fuses traditional SAST/DAST, software composition analysis, IaC/K8s policy checks, and SBOM provenance (e.g., SLSA/attestations) with learning components that prioritize, adapt, and automate. A risk-scoring engine combines CVSS, exploit likelihood, business criticality, and runtime blast radius to drive queue-aware remediation. LLM-assisted triage with policy guardrails summarizes findings, deduplicates noise, and generates secure code patches as candidate pull requests, while active learning continuously refines rules from developer feedback. For runtime, behavior models detect drift and supply-chain anomalies (e.g., dependency confusion, poisoned images) and trigger progressive delivery actions canaries, feature flag isolation, and policy-as-code rollbacks. A reinforcement-learning scheduler optimizes scan depth, frequency, and environment selection to minimize MTTR and build latency under resource constraints. The pipeline integrates with enterprise controls (zero-trust identity, secrets management, artifact signing) and publishes compliance evidence (audit trails, control KPIs) automatically. We validate the approach on multi-service benchmarks and production-like workloads, demonstrating reduced false positives, faster mean time to remediation, and lower p95 build overhead versus static baselines. The results indicate that coupling predictive analytics and autonomous orchestration with human-in-the-loop review enables continuous, scalable security without sacrificing delivery velocity