What the best AppSec and engineering stack looks like in 2026
Summary
We talk to a lot of security and engineering leads at mid-size SaaS companies. The teams that seem calm about AI-written code (and there are a few) have landed on roughly the same stack.
None of it is exotic. It's mostly about putting security where the code now gets written and reviewed, which is no longer just in a developer's editor.
Here's the checklist. If you can tick most of it, you're ahead of most teams we meet. If you can't, at least you'll know where to start.
1. You've accepted the PR volume isn't going back down
Pull requests now come from developers, coding agents, cloud agents running overnight, and people in product and ops who never used to ship code.
On GitHub, agents opened more than 40% of pull requests in September 2026, up from 17% in March, and merged pull requests more than doubled in a year to 1.3 billion.
Review hasn't kept up. A Harvard working paper covering 718 companies and 49 million pull requests found that after teams adopted coding agents, PRs went up 23% and the time to merge one went up 49%, while finished work shipped stayed flat.
At one mid-sized B2B company studied by Carnegie Mellon and Stanford researchers, PR volume grew 3.1x and the reviewer pool grew 1.5x, and the share of PRs getting a substantive human review fell from about 39% to 21%.
The best teams stopped trying to review their way out of this by hand. They assume volume will keep going up, and every other layer below is built for that.
2. An AI code reviewer handles quality
Some form of agentic code review runs on every PR, catching logic slips, missing tests and the general mess a one-shot agent can leave behind.
Copilot code review, CodeRabbit and Claude Code Review all do this job well. It makes changes better. It isn't a security review, which brings us to the next one.
3. A dedicated security review runs on every PR
This is the layer most teams are missing or doing in a way that won't hold up. The good version finds candidate files in the change, looks for vulnerabilities with the whole codebase in mind, then checks each one is actually reachable and exploitable before anyone sees it.
Findings come back in a couple of minutes with the fix, and turn into tracked issues instead of PR comments that vanish on merge.
The tell that you've got this right: developers read the findings, because there are only a few and they're real. More on that in AI code review vs AI security review.
4. Your agents get security context automatically
Coding agents read AGENTS.md, Claude Code skills, Cursor rules and Copilot instructions.
The best teams use those files to tell agents how auth, ownership and secrets work in their codebase, and they keep that context current across every repo instead of writing it once and forgetting it.
Every vulnerability they fix becomes guidance that stops agents writing it again.
5. Dependencies get checked continuously
Agents install packages to get the job done, and a version that was fine last month can have an advisory tomorrow.
Strong teams check every lockfile in every repo against known vulnerabilities whenever a new advisory lands, and they set a minimum release age so a freshly hijacked package can't slip in during a three-hour attack window.
6. The whole codebase has had a deep review
PR reviews only see what's changing. At some point someone pointed a frontier model at the default branch to find what was already there, and triaged the results by what's exploitable.
With Mythos-level models making vulnerability discovery cheap for attackers too, this one has moved from "nice to have" to "do it this quarter".
Attackers are already going this way. Exploiting a vulnerability was how 31% of breaches started in Verizon's 2026 Data Breach Investigations Report, up from 20% a year earlier, and the median time to fix a known exploited vulnerability grew from 32 days to 43.
7. Threats are written down where agents and reviewers can see them
A short threat model in the repo says what the team is most worried about, like tenant data leaks or payment tampering, and every PR gets checked against it.
8. Every finding lives in one backlog
Code findings, secrets and dependency issues all land in one place, synced to Linear or Jira and Slack, with a record of who fixed or dismissed what and why. When a customer security questionnaire or a SOC 2 auditor asks, the answer takes minutes.
The short version
Where Dam Secure fits
Dam Secure covers layers 3 through 8 from one understanding of your codebase. PR Security Reviews check every pull request in under two minutes for a fifth of the cost of a DIY setup.
Managed Security Context keeps your agents' security guidance current, and teams see 30% fewer vulnerabilities written.
Dependency Security and AI-Native SAST cover your packages and your whole codebase, and your threat models feed into every review. It all lands in one backlog.
One backlog
"Security PR reviews are critical for a scaling unicorn like Serval. General AI coding tools lack deep security codebase context and can't learn from their mistakes. Dam Secure does all of that out of the box." Sam "Frenchie" Stewart, Head of Security, Serval
Want to see how your stack holds up? Speak to our team.
.webp)