Enhancing DevSecOps with Generative AI for Secure Code Review and Threat Modeling

As development pipelines grow increasingly automated, ensuring that security keeps pace with speed remains a major challenge. Conventional static and dynamic analysis tools flag common coding weaknesses but rarely understand the developer’s intent or the broader design context. This paper introduces a framework that embeds Generative Artificial Intelligence (GenAI) into the DevSecOps workflow to support contextual and explainable security decisions. The proposed approach uses large language models to perform real-time reasoning during code review and threat modeling, reducing false positives while improving insight into potential risks. Experiments show that combining generative analysis with existing CI/CD tooling produces measurable gains in accuracy, review efficiency, and developer confidence, while also enabling teams to detect subtle design flaws earlier, streamline collaboration across security and engineering groups, and maintain stronger governance without slowing delivery cycles. Additionally, the framework enhances traceability, supports more adaptive threat modeling practices, and provides actionable recommendations tailored to project-specific architectures, thereby strengthening the overall resilience of modern software ecosystems.