AWS re:Invent 2025 - How Cathay Transformed DevSecOps with AI: A 75% Faster Security Story (SEC202)

Watch	Topic	Details
YouTube	Transition from DevOps to DevSecOps	Cathay faced challenges with false positives in vulnerability scanning, leading to wasted time and resources. The organization aimed to improve time to market, reduce costs, and enhance security hygiene. A shift-left approach was adopted to integrate security practices earlier in the software development life cycle (SDLC).
YouTube	Implementation of DevSecOps Practices	Cathay transformed its DevOps practices to DevSecOps, embedding security compliance and practices throughout the SDLC. Automation was introduced to trigger and execute security testing and scanning within the CI/CD pipeline. A blocking mode was implemented to safeguard deployments from high and critical vulnerabilities.
YouTube	Introduction of Agentic AI	Agentic AI was developed to help manage false positives and streamline the suppression process. The AI reduced the average time for reviewing false positives from 30 days to 13 days, a 60% improvement. Agentic AI interacts with developers through a portal, leveraging a knowledge base to make decisions on false positives and exemptions.
YouTube	Security Champions Program	A Security Champions program was launched with three levels to enhance security awareness and skills within application teams. Level 1 focused on aligning application teams with security practices. Level 2 provided verification and support for Level 1 decisions. Level 3 involved senior experts to bring external security knowledge and trends into the organization.
YouTube	Benefits and Outcomes	DevSecOps practices led to a 3 times more effective change management compared to traditional DevOps. Recovery time for incidents was 2600 times faster with DevSecOps. Remediation costs were reduced by 50% when vulnerabilities were addressed earlier in the SDLC. Security awareness among development teams increased by 70%.
YouTube	Future Plans and Lessons Learned	Future plans include expanding the Security Champions program, enhancing security scanning throughout the SDLC, and improving observability with more insightful dashboards. Lessons learned emphasize the importance of culture change, tool customization, and automation in achieving DevSecOps goals.

Watch on YouTube

Description

Learn how Cathay Pacific Airways partnered with AWS ProServe to revolutionize their DevSecOps approach, moving beyond basic security scanning to create a comprehensive shift-left security-first culture. By implementing AI-powered security champions, defensive coding patterns & anti-patterns, AppSec-as-Code libraries as knowledge base, customized AppSec scanning rules and RAG-based Agentic AI assistant, they achieved remarkable results: 50% cost reduction, 75% faster vulnerability remediation, and 70% improvement in developer security capabilities. Discover how this Fortune 500 airline transformed 1,000+ developers into security-conscious practitioners while managing 4,000+ annual deployments.

Learn more:
AWS re:Invent: https://go.aws/reinforce.
More AWS events: https://go.aws/3kss9CP

Subscribe:
More AWS videos: http://bit.ly/2O3zS75
More AWS events videos: http://bit.ly/316g9t4

ABOUT AWS:
Amazon Web Services (AWS) hosts events, both online and in-person, bringing the cloud computing community together to connect, collaborate, and learn from AWS experts.
AWS is the world's most comprehensive and broadly adopted cloud platform, offering over 200 fully featured services from data centers globally. Millions of customers—including the fastest-growing startups, largest enterprises, and leading government agencies—are using AWS to lower costs, become more agile, and innovate faster.

#AWSreInvent #AWSreInvent2025 #AWS