Scanning code before it ships
Jun 3rd, 2026 by Jesper Kråkhede
At Build this month Microsoft shared more about MDASH, the AI scanning system I wrote about in May. A group of security partners are now part of the preview, and the system has moved from research to the development pipeline.
That is the part I find most important. Finding bugs in released code leads to patches. Finding bugs before the code is released leads to fewer patches.
In the pipeline, validated findings appear as code scanning alerts in the tools developers already use, inline on the pull request where the code is reviewed. They can stop a build before it goes out and open work items for remediation. And the findings are also visible to the security team, prioritised together with threat intelligence and what is happening at runtime.
Why does it matter? Because it moves security to where it is cheapest. A bug fixed during code review costs minutes. The same bug in production costs a patch, a release, a maintenance window for every customer, and sometimes an incident.
It is also the realisation of what we have tried to do with the secure development lifecycle for twenty years. Back in 2020 I wrote about SDL in a Zero Trust world. The principles were right, but human code review couldn´t scale to the amount of code being written. Automated reasoning about code changes that.
And it creates an audit trail. For organisations that must show that their software was reviewed before release, every finding and fix is documented on the pull request.
Fix it before it ships, and you never have to patch it.