Security teams are deploying AI agents across the SDLC, but most of what they produce is noise: "the agent flagged something" is not the same as a finding an engineer will act on. The deciding factor between the two is grounding - automatically injecting organizational context (threat models, ownership, prior findings, code) into the agent through MCP and Dash. At Dropbox we built agentic tools spanning design review, PR review, autonomous vulnerability discovery, secret triage, and endpoint audit, and measured what grounding changes - above all, the false-positive rate, the objective signal that a finding is trustworthy enough to act on.

We walk through the architecture at each SDLC stage and share the numbers, including a published result where semantic retrieval of threat models recovered 80% of design-to-code links versus 12% from explicit linking (6.7x), and a secret-triage pipeline that closed 75% of a scanning backlog. A practitioner's account of building, deploying, and measuring agentic security tooling in production - grounded in data, not demos.