AI coding assistants approved, not blocked — across a large engineering estate

Review is not a control

Once an engineering organisation passes a certain size, security stops working by inspection — a team reviewing things one at a time will never catch up with the rate at which code is written. The work is therefore about defaults: making the safe path the one that requires no decision, and making the unsafe path the one that has to be argued for. That principle scales down as readily as it scales up, which is why the same approach works for a team of fifteen.

Secure SDLC, from threat model to triage

The work supported delivery teams across the development lifecycle rather than at a single checkpoint.

Threat modeling with the teams

Risk assessed and documented for enterprise application architectures using OWASP, STRIDE and MITRE ATT&CK, with the required security controls defined alongside the people who will implement them.

SAST, DAST and SCA in the pipeline

Static, dynamic and composition analysis integrated into CI/CD — and, just as importantly, the findings contextualised and prioritised against a risk matrix so teams get a ranked list rather than a dump.

Blocking problems before the commit

Pre-commit hooks that stop secrets and known-vulnerable code from entering the repository at all, which is far cheaper than detecting them afterwards.

Zero Trust applied to application posture

The Zero Trust model used as the frame for assessing and strengthening how applications authenticate, authorise and trust one another.

Governing the platform the code lives in

A large share of supply-chain exposure is decided by how the source-control platform is configured. Our founder designed the security architecture for the organisation's GitHub adoption, and the governance that kept it consistent as the number of repositories grew.

GitHub Advanced Security

Secret scanning, dependency review and push protection deployed across the estate.

Repository governance

Branch protection, rulesets, CODEOWNERS enforcement, signed commits, security policies and organisation-wide audit logging.

Build infrastructure

GitHub Actions runner configurations assessed against the controls that matter — least-privilege permissions and ephemeral environments.

Making AI coding assistants approvable

AI assistants touch source code, internal data and developer identity at the same time, which is why security teams often end up blocking them. Our founder defined the controls that allowed a rollout to be approved rather than deferred.

GitHub Copilot Enterprise

Access controls, an acceptable-use policy, platform hardening, logging and monitoring — deployed across the organisation.

Copilot Studio controls

Data handling, authentication, logging and monitoring defined for agent-building capability before it reached general use.

Assessing the models themselves

Security risk assessment of the code-assistance models in use across the organisation, and the governance criteria for approving new ones.

Hardening what actually runs

Alongside the build side, our founder secured the container platforms the applications run on: OpenShift, Kubernetes and Docker hardened to industry standards — non-root users, minimal layers — with automated image vulnerability scanning through RHACS and application flows between OpenShift clusters validated rather than assumed.