Context: the moment "we review security at the end" stopped being viable
INAI reported a 40% increase in security incidents in Mexico during 2025. Gartner estimates global cybersecurity spend will reach $240 billion in 2026, of which $121.154 billion corresponds to protection software. The problem is no longer whether attacks will happen — it's whether the software teams are building today already carries the vulnerabilities that will fuel next year's attacks.
NovaSoft Mexico is a B2B software factory with 85 developers across four product teams. It delivered code to clients in banking, insurance and retail — sectors with strict security and regulatory-compliance requirements (CNBV, CNSF, PCI-DSS). Its security process through 2024 was industry standard: a penetration audit at project close, plus a dependency scanner running the last day before release.
That stopped being enough the moment one of its banking clients received a critical finding in a CNBV audit — a SQL-injection vulnerability that had lived in the code for 8 months, across 47 releases. The cost of remediating it in production was 34 times higher than if it had been caught in development. And the conversation with the client was the hardest in the company's history.
The challenge
Delivery speed vs. security. NovaSoft's four teams deployed to production 15 to 20 times a week combined. Development teams face constant pressure to ship new features continuously. That speed raises the risk of introducing vulnerabilities. Over 60% of critical application errors can be caught in early development stages if automated code-analysis tools are integrated, per Fortify. Nobody on the team had time to read the 800-alert reports the scanner generated on rotation.
AI-generated code with no security review. With GitHub Copilot adopted by 70% of the dev team, the volume of code no human had written line by line grew significantly. AI has simultaneously changed all three faces of the problem: how code is written, how vulnerabilities are discovered, and how they're exploited. AI-generated code isn't inherently insecure — but it isn't inherently secure either, and the patterns that trained the models include legacy code with known vulnerabilities.
Regulatory compliance with no continuous evidence. Banking and insurance clients demanded auditable security evidence on every release — not an annual penetration report, but a continuous trail proving every change had passed security validation before reaching production.
The solution: DevSecOps with AI from the first commit
NovaSoft implemented a security architecture integrated into its GitLab CI/CD pipeline, with AI layers at every stage of the cycle.
Layer 1 — In the IDE, before the commit. Every developer installed the Aikido extension in VS Code. While writing code, the extension analyzes in real time: exposed secrets (API keys, tokens, hardcoded passwords), dependencies with known CVEs, and insecure code patterns. The vulnerability is caught the moment it's introduced — not 48 hours later in the pipeline report.
Layer 2 — Pre-commit hook. A Git hook runs Gitleaks in milliseconds before any commit reaches the repository. If it detects a known secret pattern, it blocks the push and notifies the developer with the exact context of the problem.
Layer 3 — CI/CD pipeline with AI triage. Every merge request automatically triggers SAST, SCA and IaC scanning. LLMs analyze code with contextual reasoning instead of fixed rules, identifying logic flaws traditional scanners miss. The AI triage engine eliminates 85% of the noise — of 800 daily alerts, the system presents 12 prioritized ones.
Layer 4 — Assisted remediation. When the pipeline blocks a merge request for a high- or critical-severity vulnerability, the system generates the suggested fix with corrected code ready to apply, along with the CVE reference and CVSS score. The developer reviews, approves and applies.
Layer 5 — Compliance as a byproduct. Every analysis is logged with timestamp, findings, and disposition. The security dashboard automatically generates compliance reports for CNBV and PCI-DSS audits.
Results at 7 months
| Metric | Before | After |
|---|---|---|
| Critical vulnerabilities reaching production | Base 100 | -89% |
| Average vulnerability remediation time | 18 days | 2.4 days |
| Security alerts per week the team reviews | ~800 | ~60 (prioritized) |
| Average remediation cost per vulnerability | Base 100 | -71% |
| Preparation time for security audits | 3-4 weeks | 2 days |
| Developers identifying vulnerabilities before commit | < 5% | 78% |
The most important result wasn't technical — it was cultural. Developers started thinking about security as part of their job, not as something the security team reviews afterward.
What made the difference
Real shift left, not declarative. The change was moving detection to the IDE, the pre-commit, and the pipeline, in that order — each layer catching what the previous one missed.
AI triage as an adoption enabler. The historical obstacle wasn't technology — it was noise. When the scanner generates 12 well-prioritized alerts instead of 800, developers act on them.
Compliance as a byproduct of the process. NovaSoft stopped preparing evidence for audits — now it's generated automatically as a result of daily work. The next audit from a banking client won't require three weeks of prep.
The context that makes it urgent in Mexico
With 70% of NovaSoft's team using code copilots, the potential attack surface grew. The security pipeline grew with it. For a software company delivering to clients in regulated sectors in Mexico, DevSecOps with AI in 2026 isn't a competitive advantage — it's the price of entry.
Illustrative case. NovaSoft Mexico is a fictional company created to illustrate real DevSecOps implementation patterns in the Mexican software industry. Context sources: INAI, Fortify, Gartner, Banxico, Forgenex, Cybolt — reviewed July 2026.
Qi-VantaAutomation and artificial intelligence for businesses. From discovery to production, with measurable ROI.