RuStore brings AI into infosec: how VK automates task reviews, code reviews and DAST checks

RuStore has shown a pragmatic way to use AI in information security: not as a showcase and not to replace specialists, but to offload the most repetitive stages of work within the release cycle. The infosec team has automated three areas where engineers most often spend time on basic review and filtering: first-pass handling of Security Check tasks, review of changes in merge requests, and dynamic application testing.

The logic is simple: if a machine can quickly gather context, highlight typical risks and weed out obvious problems, humans have more capacity left for truly hard decisions, disputed cases and deep architecture analysis.

This is an important shift in the approach to application security. In product development, infosec has long consisted of more than rare critical incidents and hunts for sophisticated attacks. Most of the load is constant operational work: reading task descriptions, checking what exactly changes in functionality, understanding which data is affected, which integrations appear, and where vulnerabilities may arise from already known patterns.

This work is mandatory, but it is exactly what eats experts' hours. Scaling the team to handle this flow is not always rational: as headcount grows, so does the volume of routine, not only the depth of expertise. That is why the bet on AI here looks less like a fashionable experiment and more like an attempt to redistribute time within the team in a targeted way.

The first area is early-stage triage of Security Check tasks. Engineers usually need to quickly understand what change is being discussed, where security is potentially affected and whether in-depth analysis is needed at all. In such a process, AI can gather basic context from the task description, flag sensitive areas and highlight in advance what resembles known risk patterns. This is especially useful where task volume is high and a significant share of requests ultimately needs not a full investigation but quick qualification and routing.

The second area is code analysis in merge requests. There are many repetitive checks here: handling of user input, access rights, tokens, secrets, logging, validation, external calls. If the model can walk through these layers like a checklist, it becomes not a "reviewer instead of a human" but a first filter before expert assessment.

The third area is AI-DAST, meaning the use of a model in dynamic application testing. For a security team this is a logical continuation of the same idea: some checks can be standardized, accelerated and run more consistently, without waiting for an engineer to find a window for a manual pass through typical scenarios. In this mode AI is useful above all as an assistant that does not tire of repetitive steps and can spot deviations in application behavior faster. This reduces the chance that a typical problem gets lost between release iterations simply for lack of time for a manual run.

The final decision still rests with a human: it is the engineer who assesses context, separates a real problem from a false positive and understands how critical a detected signal is for a specific product and its architecture.

At the market level, this is a good example of AI gradually being embedded into mature internal processes. The most practical value here lies not in loud promises of "autonomous security" but in lowering the cost of routine and speeding up first-pass checks without losing control. If this approach takes hold, infosec teams will be able to spend less time on mechanical task sorting and more on threat modeling, non-trivial attack scenarios and preventing errors before release. For large product teams, this will probably be the main effect: not a reduced role for the expert but a noticeable increase in their throughput.

In essence, this is about redistributing attention toward the areas where human expertise delivers the greatest value and where automation cannot yet replace engineering judgment.