The evolution of app sec: Getting off the scan-and-fix hamster wheel remains elusive

This piece critiques the scan-and-fix paradigm in application security, arguing that “shift-left” alone doesn’t solve the problem and exploring alternatives like RASP/IAST, IDE-integrated checks, and AI-driven remediation. Experts debate feasibility, performance, and developer workflow impacts, with a consensus emerging around the need for prioritization, contextualization, and smarter tools to reduce noise and focus on remediation that aligns with clearly defined risk policies.