Intelligent DevSecOps Automation Framework Based on AI-Driven Security Analytics for Agent-Based Jenkins Pipelines

Abstract

The adoption of Continuous Integration/Continuous Delivery (CI/CD) has accelerated the implementation of DevSecOps as an approach for integrating security throughout the software development lifecycle. Although various automated security tools are widely available, their outputs remain fragmented, require extensive manual analysis, and provide limited support for security-driven decision-making within CI/CD pipelines. This gap creates the objective of this study, which is to design and evaluate an Intelligent DevSecOps Automation Framework that combines AI-Driven Security Analytics with an Agent-Based Jenkins Pipeline to integrate multiple security tools, normalize heterogeneous findings, enforce a unified security quality gate, and generate contextual security advisories through Large Language Models (LLMs). The study employed an applied research method with a prototype development and experimental approach. The proposed framework integrates Ruff, Semgrep, SonarQube, and Trivy, and is supported by a finding normalization and consolidation mechanism, risk-based prioritization, security quality gate evaluation, and AI-driven advisory generation orchestrated through LangChain. The framework was evaluated using a deliberately vulnerable payment-service repository to examine its capability in detecting vulnerabilities, consolidating cross-tool findings, classifying risk, and producing mitigation recommendations together with a release decision. The results show that the framework successfully unified four security tools within a single pipeline, producing 160 raw findings that were normalized and consolidated into 37 unique findings, of which 27 were categorized as Critical or Major. Fifteen of the highest-priority findings were forwarded to the AI-Driven Security Analytics component, yielding an Overall Risk and Exploitation Risk of Critical, 14 items classified as release blockers, and an overall release recommendation of Hold. These findings indicate that the proposed framework effectively supports early vulnerability detection, cross-tool consolidation, risk-based prioritization, security quality gate enforcement, and AI-assisted security advisory generation to strengthen security decision-making in modern DevSecOps pipelines.