In a company of about ~100 developers, and ~2 pen-testers, a product is being developed. There's a good amount of diverse code coming in via github PR requests every day.
The goal is to review as much new code as possible before it gets merged.
On the one end of the extreme, it'd be something like 'review every PR and don't allow merge before a pen-tester vets". Clearly this is very resource consuming. The other extreme would be 'let everything pass through and do per-module pen-testing on releases'.
Are there any meaningful PR coverage strategies laying in between these two extremes?
Note: not asking about integrating automated code analysis into the build pipeline, the goal is to have the manual audit for as much code as possible in a meaningful way. Also, not asking about code review methods (such as methodology to identify certain classes of bugs).