TL;DR:

In a recent OX Security webinar, Atlassian CISO David Cross argues shift-left is giving way to “shifting down,” pushing security, privacy, and compliance checks into AI coding agents themselves, so they run proactively instead of as gates developers hit after the fact.
David lays out four pillars for supply chain maturity: a dedicated threat intelligence feed, trusted repositories/artifactories, enforced build policy, and disciplined update timing, as well as a warning that developers (and agents) will always find the path of least resistance around friction they don’t understand.
The throughline: Policy alone doesn’t hold. Infrastructure without enforcement and detection just becomes friction that developers (and agents) route around.

Security teams have spent the better part of a decade trying to shift left — catching issues earlier in the development lifecycle instead of at the end.

It worked, to a point.

But in a recent OX Security webinar on AI and supply chain risk, Atlassian CISO David B. Cross made the case that the model itself needs to evolve again, and this time the shift isn’t left. It’s down.

The conversation, hosted by OX’s Field CTO Boaz Barzel and Security Research Lead Moshe Bustan Siman Tov, covered a lot of ground, but today we’ll focus on David’s framing of where security work actually belongs, offering a clear through-line for teams trying to figure out what to prioritize next.

What “Shifting Down” Actually Means

David framed the shift in a piece of advice he picked up years ago: “Security organizations are a customer service organization… to the developer.”

If that’s true, he argued, the logical next step is obvious now that AI is doing so much of the coding.

“We’ve got AI doing the code, right? We should have AI doing all the things proactively for them,” he said.

Rather than security acting as a gate a developer hits after code is written, the coding agent itself should be triggering security, privacy, and compliance checks as part of the workflow.

He summed up the idea with a phrase he’d picked up at an event in India: “It’s about shifting down, everybody. We’re shifting down to the agents.”

If developers stop worrying about gates after the fact, the checks move to where the work is actually happening.

The Four Pillars of Supply Chain Maturity

That reframe only works, David was clear, if it’s backed by real infrastructure. He laid out four pillars he considers non-negotiable for any organization managing AI-era supply chain risk:

A dedicated threat intelligence feed. Not just “bad websites at the edge” the way traditional network security has worked for years, but one built specifically around malicious packages and the broader package supply chain. David argued this is a gap the industry hasn’t closed: “There is a need in the industry right now… a threat intelligence feed just on the supply chain.”
Trusted repositories and artifactories. A controlled, known-good source of truth for every package and image an organization builds off. It’s the true foundation, and everything else sits on top of it.
Enforced build policy. Trusted infrastructure only matters if teams actually build from it. “You only build from these,” David said. “The humans, you can’t go around that. The agents cannot go around that. You can detect when someone tries to go around that.”
Deliberate update timing. Bringing in new package versions only after testing and threat-intel review, not delaying for weeks, but not pulling in changes the moment they land either.

Underneath all four pillars is a warning about human (and increasingly, agentic) nature.

“Water will always take the least resistance,” David said. “The developer… they’re gonna find a way around it.”

A policy that isn’t paired with real detection isn’t a policy. It’s a speed bump, and speed bumps get driven around.

That tension between enabling velocity and maintaining control ran through the rest of the discussion too. David and Moshe both pointed out that AI agents don’t yet carry the judgment that experienced developers do. The same models writing code are often the ones being asked to review it for security issues, and there’s no guarantee they’ll catch what they missed the first time.

David’s answer wasn’t to slow agents down, but to build monitoring and threat intelligence around them the way security teams once had to build controls around scripting tools that became ubiquitous and powerful almost overnight.

Proving It’s Actually Working

The conversation also touched on how organizations can actually prove any of this is working, rather than assuming it. David drew a direct parallel to unit testing, saying that code became trustworthy once teams built the tests that validated it, over and over, as things changed, not just because it shipped.

Supply chain controls need the same discipline. Internal red-teaming came up too, and David was clear it’s about more than testing whether outside attackers can get in. It’s about whether internal controls actually hold up under pressure, or whether there are quieter paths around them that nobody has gone looking for yet.

None of this replaces shift-left discipline; it extends it. The difference is where the weight sits.

In a world where a meaningful and growing share of code moving through the pipeline was written by an agent in the first place, governance has to move to where the work is actually happening, not stay parked at the end of the line waiting for a review.

Want the full context? This was one thread in a much broader conversation on AI, MCP, and supply chain risk.

Watch the full webinar recording for the complete discussion.

The post Shift Down, Not Just Left: Why Security Must Adapt to Agentic Era appeared first on OX Security.