Why AI + DevSecOps Is the Future of Software Security With Patrick J. Quilter Jr

Get ready to discover some of the most actionable DevOps techniques and tooling, including performance and reliability with some of the world's smartest engineers. Hey, I'm Joe Colantonio, host of the DevOps Toolchain podcast, and my goal is to help you create DevOps toolchain awesomeness. Hey, it's Joe. And today's episode is packed with insights you don't want to miss. I'm joined by Patrick Quilter, CEO of Deploy360 and a true pioneer at the intersection of automation, security and AI. Patrick started out just like us as an automation engineer, but his journey took him from launching his own consulting company to selling it, to acquiring another, and now leading a cutting edge DevSecOps platform trusted by the Department of Defense. In this conversation, Patrick shares how testers can make the leap into security, what agentic AI really means for DevSecOps pipelines, and why AI is more about speed and security than replacing coders. If you've ever wondered where AI and DevSecOps are heading, or how you can prepare your career, what's coming next, stick around, because Patrick brings both the vision and the practical advice you need. You don't want to miss it. Check it out. Hey, before we get into this episode, I want to quickly talk about the silent killer of most DevOps efforts, that is poor user experience. If your app is slow, it's worse than your typical bug. It's frustrating and in my experience and many others I talk to on this podcast, frustrated users don't last long. But since slow performance is as sudden, it's hard for standard error monitoring tools to catch. That's why I really dig SmartBear's Insight Hub. It's an all in one observability solution that offers front end performance monitoring and distributed tracing. Your developers can easily detect, fix and prevent performance bottlenecks before it affects your users. Sounds cool, right? Don't rely anymore on frustrated user feedback, but I always say try it for yourself. Go to smartbear.com or use our special link down below and try it for free. No credit card required. Hey Patrick, welcome to the Guild.

Hey, thanks Joe. Great to be here.

Awesome. You know, we've been talking for a while back and forth on email. I've been following you for a bit on LinkedIn, so I wanted to join you on this podcast. I think you did a big announcement around security, which we're going to dive into the but before we do, maybe a little background, like how you got into DevOps, how did you get into security you know, what's your background story?

Sure, absolutely. So basically I started out doing an independent consulting company around automated testing. Actually, if I could take a little divergence here, I want to plug you for a second because I've been following you since the early 2000s. I think you're going on now. And I was a big automated testing guy and I, and you know, I had like a lot of people back then. I had my pet projects and frameworks and UFT was the big thing back then. It was Quick Test Pro when I was following you. And there was a period when Mercury Interactive sold to HP and Mercury Interactive had probably one of the best knowledge bases with their products. I mean, you could get answers to windrunner Quick Test Pro and like the answers would be spot on. This is before all the generative AI stuff before that. Right. So that was like everybody's goto. And then during that period they took that knowledge base away, I think when it got moved over to hp. So where was the only place to get information? If you googled, your stuff would come right to the top. Like you were a lifesaver for myself and a lot of people that like when you get into those knots where you, you just can't find any good support or good ways to, you know, why is this breaking on me? How do I fix it? Your stuff was always there, so I've always had you bookmarked just because of things back in the early 2000s. I can't believe we have to say it goes back that far, but that was the reality of it. But yeah, anyways, back to our history. So under that consulting company developed that pet project, implemented a little bit more, was fortunate enough to, through some customers that we had, I met somebody that ended up buying my consulting company. So that company was very much more blockchain focused. So we worked together in that configuration for a while. My legacy company basically continued to deliver the same type of services, but we started to slant more towards the blockchain and crypto side with the automation. Shortly after that we took a little divergence and then ended up trying to expand a little bit more. We, you know, at the time, this is around 2017, blockchain was still a complicated and sophisticated technology, but it was going in and out of style, very volatile. So we wanted to put a more firm step forward in going into continuing application development. So we ended up expanding my legacy product into more of a DevSecOps platform. So we expanded more out. We wanted to get more into the development space and provide a full lifecycle experience that obviously incorporates all the automated testing. But you know, that was the big step forward then. And then, you know, we had some success over the last two years and expanding our company. We did an acquisition of a DoD company and then their name was actually Deploy360 and we just took that name and made it our entire operation now. So, you know, to summarize, it's been a journey of going from different complicated technologies, but there's always been a big push for us and you know, where our heart really exist is in the application development space. So we're providing software these days that gives us a secure way to develop and the work that we've been doing at for the last four years, not that we did this on purpose, we kind of got lucky here, it actually can be transformed very easily into the new agentic approach. So we're well set up to continue doing what we're doing right now.

So Patrick, you start off as an automation engine. Thank you so much for. I wish my site still came up as the first thing. I have companies now with billion dollar budgets that just slam out the automation sector and it's anyway, it is what it is. But how do you make the pivot to security? I've always been trying to push that testers should learn more about security because I think it's only going to help them. But it's always been a hard push. I try to do a secure guild. I didn't get enough people to attend. So how did you get into security? Did you think if someone is into automation as well, that security is a good thing to add to that tool? Toolbox?

Basically yes, I absolutely do. Because if you're an engineer that's doing just automated testing, you're used to working with UIs or mobile applications or something, writing, writing test cases. I think all the security stuff and the tools are a natural fit for you because you're already in that mindset of building automated workflows close, making sure everything goes from beginning to end and you know, it completed the task that you were supposed to do. So that was kind of where I was alluding to before, where we expanded into the DevSecOps world because that's just a lot of automation. I mean 80% of that world is working with tools and working with automation. And the step towards security might be a little bit easier than you think because you can get your hands on a bunch of open source tools that do that. As long as you give it, you know, tell it where to find code, you know, repositories or whatever the mechanism is that you're submitting code to these tools. If you can figure all that out and you can script it, which you should be able to do. If you're in that automated mindset, you can get your hands on these things and then you can build pipelines. And yes, you'll have to learn, you know, it's not like VB scripts. If you were going back to the UFT days, you're going to have to pick up some, maybe some shell scripting work, learn to work with J. But I think, you know, I think people are doing that anyways. So, you know, it's really more of that. It's really concentrating on your workflows, managing the tools, calling those tools in order and they do a lot of the security work. You don't necessarily have to be an expert on dissecting or doing the analysis on what those tools are producing. You just want to be able to make sure the automation runs reliably and then get some reports at the end that you can share with your development team and let them do the analysis.

Love it. So I also, what I'm impressed by you is you start off as an automation engineer. Sounds like you started your own company, you then sold your own company, started another one and then you got so successful you're able to acquire another company. Like I think that might be a model for people that are afraid about their job to give them a little hope. Like, how did that all happen? Was it just like, like me, I just stumbled into it, just dumb luck or like were you always into business? Like, how did that happen?

There's always that luck factor, right? And it sounds good when you give a one minute explanation of how we went from A to Z. But there's certainly a lot of challenges, a lot of bumps in the road. You know, it's not necessarily for everybody but if you, you know, if you're somebody out there and you are interested in that type of challenge and add into your career there. For me it was more like, you know, I started off with a regular 9 to 5 job and that's where I learned the automated testing. And I said, and then I just asked myself, what else can I do with this? And with each job I would meet new and interesting people that would, you know, have a little piece of the puzzle. So as you start putting it together, you're like, okay, maybe I can take this leap and do some type of independent consulting and carry around my tool as a value add. That was step number two for me. And then you see a little bit more and you talk to more interesting people and they give you some ideas on how you can turn that into maybe more of a, a product with A license or SaaS setup or something like that. And it just keeps iterating. If you keep asking yourself that question, where can I take it next? Where can I take it next? And then yes, you gotta hope you get lucky along the way and definitely expect things to go wrong and be ready to handle those.

Yeah, for sure. So speaking of, where can I take it next? You're, you're on top. You're like right on trend with what's happening now with AI. I think you describe yourself as AI driven DevOps. Is that correct?

Correct.

What are your thoughts on AI? A lot of people are afraid of AI. Once again, you seem like not. You embrace things. Why does it seem like you're embracing AI rather than being afraid of it or saying it's nothing?

Yeah, I mean it's hype, right? There's a lot of hype out there these days and there's, you're going to see a lot of overexcitement and overemphasizing the impact that AI could have, especially in the software development space. And where we've seen that the most is encoding. The coders are, you know, we're not going to need coding anymore. These AI tools are going to take care of everything. And it's not been our experience, you know, this landscape is changing by the week. So I think we're monitoring what's out there very closely. And I don't see anything out there that we've gotten our hands on and experimented with to say, ah, this is going to replace, you know, thousands of workers. We haven't come across that. The impact that we do see is that for those that are, you know, serious about the coding career, like they're good experience coders, they can move a lot faster with these tools. The things that they would have to initially set up your initial routines that you might have to write. This thing can get you started, it can get you down that path and then experienced and well skilled developers can keep adding to that. So that's what I think addresses the fear people think, you know, we are not even going to need experienced developers anymore. But that's totally not the truth. And I'll even give you an example I've seen and I've run into this myself, I mean, I would consider myself like a B plus coder. And with this I'm trending more towards the A side. But there are definitely been some situations where I've gotten myself into a loop where the AI is telling me to write the code a certain way. So I do it and then it doesn't work and then I tell it and then it like almost goes into a loop where it gives me the old code all over again. So. And if you're not looking at that and paying attention to that, you're just copy and pasting copy, paste and running and hoping that it works, you're going to get yourself into a big problem. So that's kind of how to put it all together. You can see just right then and there. It still needs a human to interpret it and move it and got and, and almost guide it so it can guide you 100%.

I've been messing around with Cursor and I just pretended I didn't know anything about auto automation. I said, here's the playwright. Mcp, log into this and give me the stat from this table. And it's been like three days and it's still not working. Like you said, I keep accept, accept, accept, accept. I'm pretend like I don't know what it's doing and it still can't get it right. But what I did notice is even with, when I do get serious with the, it has a lot of security issues. Like I said, it leaks things to the console. And if I didn't know, I had to ask, hey, make sure you make this secure. I said, oh, I found all this, all this stuff that's not secure. Well, you created the code. Well, the AI created the code, so why wouldn't it create it secure? So is that something people need to be aware of as well?

Yeah, and it's, it's like, it's got a, a bit of a personality about it. Like it's, it's almost blaming you for, well, this is your code and yeah, there's something wrong with it. How did you do that? I got this from you, buddy. So that's why we're focused on DevSecOps. We want to have AI involved in the entire life cycle. All the emphasis right now are maybe 95% of the emphasis is on code generation. So if you focus on the life cycle, exactly what you're talking about is going to catch that. So the way our product is set up right now, you do your vibe coding in the, you know, you can do it in your favorite ui. We have one that's part of our platform, but once that gets generated, we have within our product the workflow to send that code to our security scanning agent. So we have a number of agents interacting together. The agents themselves are the kind of the smaller unit that you can almost think of that as your team. It's broken up into DevSecop phases. And each of those phases basically represents another agent. So in our scenario here, we have a development agent that lets you do the vibe coding. That vibe coding gets passed over to the security agent. The security agent will do its scan on the static code analysis, for example, and then sends the results back to the development agent and the development agent should fix it. And then there's always a human in the loop to make sure that that conversation and that flow continues to run smoothly. But those agents, those two agents just right there do all the work together.

How's that work? Is someone using in their, their ID or your id they're coding or they're using it to code like call me this. And then they press a button, say, now go talk to the security agent. Or is it. Are these agents just working on their own almost independently of that?

Yeah. Well, in their final implementation, they're going to be working on their own. And maybe it's fair to give where we are in our development cycle and I'll even take a step back and how we got to this particular setup that we're going after. Like we said, we do a lot of work with the Department of Defense and they're the ones that have, from my perspective, have really coined the phrase DevSecOps. That term is very important for them would. If I didn't run into the people that we're working in now, I would just consider it all DevOps. It's just, you know, but to them, security, it was, you know, forefront. It needed to be in this acronym. And then the way that they break out their phases explains all of that. They have security involved in every phase. It's much more elaborate if you think about that DevSecOps infinite loop. Their loop has several more steps in it than your, you know, your typical commercial loops or the way that they view the world of that life cycle. So there's even a lot more that defines the details into what they consider the DevSecOps life cycle. But in the end it ends up being a ten step disciplined approach. So we took that concept and there's a lot of documentation that a particular group in the DoD, they're called DoD CIO and they publish this information publicly. Anybody can go out there and look, you want to see like a robust implementation of DevSecOps they do all the thinking and documenting and publishing for how you might want to think about implementing it. There's a ton of guidance out there. So we took that guidance and we essentially fine tune our models to meet those standards. Then we built our UI to incorporate those 10 phases. And then again those 10 phases end up being the specialized agents that work with each of those. And now as I mentioned, we've been working on this platform that we've had for like four years. A lot of what we're able to reuse is the backend that we developed. It's very virtualized, dockerized. We can port it around to a number of different clouds and actually physical hardware. And that's what I was saying turned out to be somewhat of a godsent for us that we didn't know agentic was coming when we were working on this. But it turns out that's like 80% of the legwork. It's not all that hard to get hook a UI front end up to an LLM and get a response back, even though that's where it looks like all the hard work is happening, but it's actually bolting that stuff onto a robust backend that has all the information that you need. So that's where we are in our development cycle. We're taking the Agentic piece and hooking it into our backend one agent at a time. We're about to roll out the third 1/3 out of 10. And it is to answer where you were, I think you were going with your very initial question is how do these things communicate to each other? You know, there's RAG architecture and there's vector databases that hold memory. So all those things from the Agentic layer are at play so that these tools, these different agents, can communicate with each other. And they know exactly where assets are in the pipelines because they all have access to central memory.

So I guess what I'm really surprised by just sent me is the dod. I would think they would not be very friendly towards agentic AI. So is that a miss like a lot of people like? Oh, it's not. It'll never work in industries like finance and banking. But if you're using it for dod, I would think that crushes all those thresholds.

It does. If you look at the RFPs that have, you know, this is all public information, any of the RFPs that are out there, and the last maybe three months there's been an explosion. The new administration is very bullish on AI and utilizing that within all different agencies. So I think a lot of it came from that push. I know last year and in the year prior it was, you know, something that the DoD wanted to be on top of in case it became extremely relevant. And I think this year there is even more of a financial push to start figuring out how they can get commercial off the shelf products into the DOD and utilizing that. That seems to be the directive, at least today.

Nice. So you talked a little bit about Vibe, maybe a little more info around that. Is it, is it, it's your own developer environment or is it like some sort of VS code type of implementation?

Yeah, we send out, we wrap VS code into our overall architecture. So you might have remember me saying just a minute ago, there's a backend that, that we have, so that backend is locked down, secure and it's in a state where you can take any of these assets and move them around to different environments. So we were able to take a VS code backend and include it in our overall structure. So it's now portable, it ships with everything that we provide. And then on top of that there are some, you know, you can add in any of your favorite open source LLMs through continues the interface that basically allows you to switch between LLMs and do your Vibe coding. So from that standpoint for us there's a number, there's several very good, and you brought up Cursor already one of them that does the Vibe coding itself. So we did not necessarily want to compete with that, but with some open source utilization and packaging it all in with our platform, we're able to, you know, give a secure, what a hardened experience with VS code and some of these other AI agents. So we take care of a lot of the security. A big thing for us is what's called the DevSecOps supply chain. So we want all the tools to be configured right and with the right security checks already in place, already scanned before we push those out to customers.

Love it. So you did mention Claude. Not Claude. I think you mentioned OpenAI. Do you find for security using local LLMs are more secure. Is that, is that also not a true statement?

Yeah, well, if you want something that if you had to put everything side by side and you wanted to say if I could pick one configuration that was more bulletproof than the other, which one would I pick? Now, I don't know of any major issues or major breaches or any crazy stories out there with security around any of the, you know, whether it's Claude, OpenAI chat, GPT, you know, all those things, but it's a risk. Anytime you're going from your local laptop or if you're at work, you're going out of your network and into somebody else's network. There's a risk there. What if we could get all the same benefits that OpenAI provides and you never had to leave your network? So this has actually been a focus of ours. We have what's called a, an edge installation where we take some Nvidia hardware and as I mentioned, our solution, our platform is virtualized. All Docker. Whatever we run in the cloud, we can package the same stuff up and run it on local hardware. And when we push this on the video hardware, which you kind of need because the LLMs chew up a lot of memory, a lot of GPU. So when you push it onto there, you could essentially package up our entire solution and be able to send that hardware to an organization who could, with the proper security protocols and procedures in place, plug that into their network and they can get the experience of whether it's developing software or just asking questions like you would a regular chat GPT. And that traffic never has to leave your network. So you kind of get the best of all worlds there. So are there any study, all this stuff is new. Are there any studies out there or anything that makes it clear? No, but intuitively, again, I, I pose it to you and your audience. If you could lock everything down and get the same experience, your data and your traffic never has to leave your network, then doesn't that intuitively seem like it's more secure?

Right. Right. Yeah, for sure. So I would also think with developers and testers that they have a certain workflow that they enjoy, certain environment that they're used to. If they needed or wanted to use your solution, how much of that would change, if that makes sense?

Yeah. From the developer's perspective, not it doesn't have to change. So I guess there's two audiences to look at it we would obviously want to push. So the developer working with the development agent, we would want to encourage them to utilize our hardened versus code and AI experience because we've baked in all the security and organization around that if they didn't want to do that, they could continue to work on probably their same, you know, versus code. It seems like, you know, that a ton of people are using them maybe more than anything else. I don't know. My only other experience is really with Eclipse. I, I'm sure there's still that out there, but I think people really gravitate to VS code. So let's just take that for example. They could take their VS code that they already have installed with all their files on their local system. However they're managing and organizing whatever they're used to and connect that into our environment so they have the ability to use either or, and then they can, you know, anything that they develop if they wanted to push that code to our security agent to do the scannings, you know, and we do all types of scans. We do that security agent does dynamic scanning, it does container scanning and something around networking. So they can utilize all of that and you know, that just becomes part of their workflow. I'm, I'm sure they're probably already used to working in VS code and then sending things to GitHub or GitLab. But you know, there's some advantages that we're providing that they can still do all of that stuff and maybe stay in a more secure environment.

Absolutely right. I know a lot of people hate this question, but I like it. So we're almost, I mean only four months away from 2026. I'm just curious to know if you were had a crystal ball, where do you see AI and DevSecOps going maybe in the next year to three years? I know it's hard to do that, but any pulse that you have speaking with the like DOD and people like that, where you see the industry going.

I see it seems like this, starting this summer there was a, a big interest in AI from venture capital perspective. I mean everybody's been talking about it, everybody's been weighing in on it. It was a huge topic. Starting from this summer, I'm starting to see over the past two weeks, you know, I, I'm on LinkedIn all the time monitoring the conversations and even right now it feels like the hype is cooling off a bit. So what I think happens next is that over the next couple of months these pilot ideas or these, you know, less thought out or less developed AI ideas start to fade away and then it becomes a little bit more serious. If we're going to invest capital, is there like real substance with these AI solutions out there? Is there something out there that's working? So I think from that perspective that a lot of energy is going to go in that and I really think, and why we've gone, made sure that we've maintained a very portable virtualized solution and pushing it onto edge devices. I really think there's going to be a migration away from cloud. Not massive and not for everybody. I think, you know, your Fortune 500 companies are going to continue to use cloud. They have big budgets. These GPU costs I guess are not a huge deal for them or it's worth it still for them just to be able to utilize that. But for your smaller and medium sized businesses, I think if somebody comes in with a solution that drives down the GPU costs and gives them the AI experience, there's going to be movement, significant movement in that direction.

All right, Patrick, I know a lot of people hearing this. A lot of people need to get their hands dirty. They probably want to try this. Do you have any like early access, a beta where people can actually try for themselves to see if it actually lives up to the hype that we talked about today?

Yes, absolutely. As I mentioned, we're rolling out this product little by little and adding the agents on top of the existing product that we already have. So we would absolutely love to have some early access customers. You know, the value there is that they get the solution at a significantly reduced price and we obviously get the feedback that we're looking for right now as technology is changing all the time and there's things that we want to get in our platform and get immediate feedback. So hopefully it's a win win for everybody if, if any folks are interested.

All right, Patrick, so like I know, don't answer everyone. Who's the perfect customer? If someone's listened to this, who would be the perfect ideal person that would get the biggest bang from, from actually trying the, the beta and seeing if it really would help them for what they're doing?

Yeah, I think our the small to medium sized customers, you know, if you're a company of that size and you know, you're realizing that you need to scale, you're hearing the time savings that DevSecOps can provide. Keep in mind it's not just about coding, it's about the full lifecycle. So you know, we can provide everything and you don't have to spend a fortune to get to that point. So you would be perfect for this early access program.

Love it. K Patrick, before we go, is there one piece of actual advice you can give to someone to help them the DevSecOps efforts and what's the best way people could find and learn more about you or more about your company? Deployed 360.

Sure. So with DevSecOps I think it's just, you know, I'm going to plug it once again that you got to stay up on the latest information DoD CIO. If you Google that, it should pull up their homepage and they've just published so much information, you know, it could take you probably a good three months before you exhausted it all. But you know, you start getting that background there and I, I'm not ashamed to admit it. I'm a, I'm a big OpenAI Chap GPT fan. So I'm on there constantly. If there's a concept that I don't understand, I'll peel off an hour and make sure that I do understand it. So I would encourage people to do that. I'm also a hands on person so I like to get into the coding and configuring. That's how I start to understand it. So if you're a person like that, those are three steps. Just get a, a source that you really like for your information. Make sure you understand it and you have the tools out there like never before. I shouldn't say like never before. Joe Calantonio way back when used to give us that experience. But since we don't have that anymore. Use your chat GPT to really understand it and then spend some time implementing it. And it doesn't have to be a full implementation, but just make sure you know how all the dots connect and then you'll be able to go into conversations and understand things better and contribute better and yeah, as far as where to find things for us, I mean certainly, you know, our company puts out a lot of information about this evolution and devsecops and mirroring it with AI. So definitely follow us. Our website's out there. I'm sure Joel will have that as a some follow up information. I post on LinkedIn constantly. So like I said, I'm constantly monitoring the news and I'll, I'll give some opinions there. And we keep our LinkedIn page very up to date and we'd love some community interaction and we'll have links to.

All this awesomeness down below. All right, before we wrap it up, remember, frustrated users quit apps. Don't rely on bad app store reviews. Use SmartBear's Inside Hub to catch, fix and prevent performance bottlenecks and crashes from affecting your users. Go to smartbear.com or use the link down below and try for free for 14 days. No credit card required. And for links of everything of value we covered in this DevOps Toolchain show, head on over to test guild.com p201 so that's it for this episode of the DevOps Toolchain Show. I'm Joe. My mission is to help you succeed creating end to end full stack DevOps toolchain awesomeness. As always, test everything and keep the good. Cheers. Hey, thank you for tuning in. It's incredible to connect with close to 400,000 followers across all our platforms and over 40,000 email subscribers who are at the forefront of automation, testing and DevOps. If you haven't yet, join our vibrant community at Test Guild where you become part of our elite circle driving innovation in software testing and automation. And if you're a tool provider or have a service looking to empower our guild with solutions that elevate skills and tackle real world challenges, we're excited to collaborate. Visit test guild.info to explore how we can create transformative experiences together. Let's push the boundaries of what we can achieve. Oh the Teskill Automation Testing Podcast with hoots and liars the bards began their song A tune of knowledge, a melody of code through the air it spread like wildfire through the land Guiding tester showing us secrets to behold.