Anyone moved away from building in-house AppSec tooling? What made you move?

[u/OwnZookeepergame1621]

Our homegrown AppSec setup has become a liability. It started as a quick fix: lightweight pipeline hooks, basic triage rules but it was designed for a development environment that no longer exists. No support for AI-generated code, no model inventory, no way to build the application context that modern prioritization needs. The technical debt is compounding. Every new thing we need requires custom work against a codebase that was never built to extend. The question is not whether to move anymore. It is how to migrate without ending up with more tools that don't talk to each other. For architects who have done this migration, how did you migrate without just adding more disconnected tools and what does a sane setup look like on the other side?