Building an Advanced LLM-Driven Vulnerability Scanning Pipeline for Your Code

We start with why simple prompting underdelivers, then take SAST apart (sources, sinks, taint propagation) so you know where it misses and why. From there: using LLMs to improve SAST output, using context to improve LLM-driven scanning, and combining the two.
Then the hard part: cutting false positives with existing test frameworks, fuzzing harnesses, live test systems, and skeptical triage against source alone. We finish with remediation.
By the end of the training, you'll leave with a working pipeline design you can adapt to your own codebase and toolchain, not just a mental model of the ideas.

About the training
The training balances short lecture segments with hands-on exercises. Each concept is introduced, then immediately applied: you'll run classic SAST tools against sample codebases, wire LLM passes around their output, and iterate on prompts and context to see how each change shifts the false positive/false negative balance.
Participants work with provided sample projects and toolchains throughout; those who want to try the pipeline against their own code are welcome to bring representative (non-sensitive) source.

Learning Objectives

• Explain why naive "find security problems" prompting underperforms, and what the probabilistic nature of LLM output means for scanning pipelines
• Describe how classic SAST works, including sources, sinks, and taint propagation, and identify the structural causes of its false positives and false negatives
• Use LLMs to post-process and improve SAST findings
• Use codebase and runtime context to improve raw LLM-driven scanning
• Design a pipeline that combines AI-driven SAST enrichment with LLM-driven scanning rather than treating them as separate tools
• Cut false positives using existing test frameworks, fuzzing harnesses, and live test systems
• Apply skeptical triage techniques when only source is available and no test infrastructure exists
• Take a scanning pipeline through to remediation, not just detection