From Noise to Signal: Automated Context Grounding for Low-False-Positive Security Agents

Security teams face a two-front squeeze: AI now writes more of our code, faster and in bigger changes than security review was built for, while AI-armed attackers get better at finding the bugs that reach production. We can’t staff our way out of either front, so we put our own agents to work first. But most of what security AI produces is noise: “the agent flagged something” is not the same as a finding an engineer will act on. The deciding factor between the two is grounding - automatically injecting organizational context (threat models, ownership, prior findings, code) into the agent through interfaces like MCP and Dash (our universal search). At Dropbox we built agentic tools spanning design review, PR review, autonomous vulnerability discovery, secret triage, and endpoint audit, and measured what grounding changes - above all, how much of what they surface is trustworthy enough to act on.  

This talk shows how security teams can deploy AI agents effectively by reducing false positives through organizational context injection, with results measured across the SDLC. Semantic retrieval of threat models recovered 80% of design-to-code links versus 12% from explicit linking (6.7x), and a secret-triage pipeline resolved four in five of a scanning backlog without routing it to a developer. The same context grounding drives pull-request review at scale, cutting scanner noise by roughly 13x into a prioritized set of real issues without dropping the serious ones, and a high-fidelity bug-bounty triage agent whose accept/reject calls matched the human verdict in nearly every decided case.

About the Presenters: Po-Ning Tseng

Po-Ning Tseng is a Senior Security Engineer on the Product Security team at Dropbox, where he builds preventive controls and automation to eliminate entire classes of vulnerabilities. His work focuses on securing every stage of the development workflow and enabling teams to ship secure code by default.
Before Dropbox, Po-Ning conducted research in the Network Security Lab at National Taiwan University and the Systems Software and Security Lab at Georgia Tech, and competed in CTFs with Balsn and r00timentary. He is passionate about web security, sandbox security, binary exploitation, and scaling security through prevention engineering and tooling.