TL;DR: AI-accelerated development is widening AppSec gaps because 76% of AI-generated code still needs security refactoring and developer productivity gains are outpacing review capacity, according to Checkmarx, IDC and The New Stack. The security model now has to move from passive finding to context-aware action, or risk will accumulate faster than teams can remediate it.
At a glance
What this is: Checkmarx’s analysis argues that AI-generated code is widening AppSec friction because security teams can no longer rely on passive scanning when developer velocity and AI-assisted output are increasing together.
Why it matters: For IAM, AppSec, and DevSecOps teams, the shift matters because control points must move closer to code creation, policy enforcement, and risk context rather than assuming review will catch issues later.
By the numbers:
- Developers using GenAI tools like GitHub Copilot are reporting 35% productivity gains, according to IDC research cited by Checkmarx.
- 76% of AI-generated code requires security refactoring, according to The New Stack research cited by Checkmarx.
Context
AI-generated code changes the AppSec problem from finding defects after development to controlling risk while code is being assembled. When AI assistants help developers move faster, traditional scan-and-ticket models struggle because they assume security can catch up after the fact. The article’s core point is that this assumption no longer holds in AI-accelerated delivery.
The identity connection is indirect but real: the people using GenAI tools are not the only actors in the control chain. AI assistants influence code creation, policy interpretation, and remediation timing, which means governance has to account for both human decision-making and machine-assisted execution. In that sense, the article is really about control placement, not just code quality.
For security programmes, this looks less like a tooling gap and more like an operating model mismatch. Teams that keep treating AppSec as a review function will keep absorbing friction that now belongs earlier in the development workflow.
Key questions
Q: How should security teams manage AppSec when AI is writing code faster than humans can review it?
A: Teams should shift from discovery-centric reporting to remediation-centric governance. That means measuring mean time to remediation, prioritising exploitable findings, and embedding automated validation into the SDLC so security can keep pace with development without lowering trust in the results.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale. That means the risk is not limited to software defects. It extends to the trust boundaries that govern users, service accounts, and any downstream system that accepts those credentials as valid.
Q: What do organisations get wrong about scanning AI-generated code?
A: The common mistake is treating more scanning as a complete answer. In reality, high-volume findings create noise unless teams can prioritise exploitability, exposure, and business impact. Organisations also miss the governance layer, where AI tools and agents need ownership, permission boundaries, and auditable actions.
Q: How should AppSec teams govern AI agents that assist with coding and policy?
A: Treat them as governed workflow actors with tightly defined permissions, auditability, and task scope. Their value comes from translating findings into action in the developer toolchain, but that only works if their behavior is constrained by policy and monitored like any other security control.
Technical breakdown
Why AI-generated code creates AppSec drift
AI-generated code changes the unit of risk from individual developer mistakes to high-volume, fast-moving code assembly. When developers accept suggestions from GenAI tools without deep line-by-line scrutiny, the result is often insecure patterns, outdated dependencies, and misconfigurations that are already embedded before traditional scanning runs. This creates AppSec drift, where the control model lags the delivery model. In practice, the security team is not only chasing more findings, it is chasing findings that are distributed across more code paths and shorter feedback loops.
Practical implication: Move security controls upstream so risky patterns are intercepted during code creation, not after merge.
Why passive scanning is no longer enough for DevSecOps
Passive scanning assumes security can observe code, file defects, and wait for humans to act. In AI-accelerated development, that sequencing breaks because code volume rises while review attention fragments. The article’s central operational critique is that findings without intervention do not reduce risk fast enough. That is why the shift is toward agentic intervention, where security systems can interpret a finding, propose a fix, enforce policy, or guide remediation in the developer workflow itself. The goal is not more alerts, but less unresolved risk.
Practical implication: Replace alert-only controls with workflow-integrated enforcement that can act on policy and remediation context.
How context-aware AI agents change the AppSec control plane
Context-aware AI agents in AppSec are not autonomous software wanderers, but role-specific systems that can act within defined policy boundaries. The article points to three friction points: security versus speed, policy versus practice, and risk posture versus visibility. A context-aware agent can help resolve these by mapping findings to code, policy, and business impact instead of treating all issues as equal. That changes the control plane from a single scanner output to a coordinated system of interpretation, prioritisation, and action across development and security tools.
Practical implication: Define agent permissions tightly and use them to translate findings into governed remediation actions.
NHI Mgmt Group analysis
AI-generated code is forcing AppSec to move from defect detection to governed intervention. Traditional application security assumes code can be reviewed at a pace that remains meaningful relative to development speed. AI-assisted coding breaks that assumption by increasing output volume and compressing review windows, which means the real control point is now at creation and policy execution. For practitioners, that means AppSec operating models need to be redesigned around actionability, not just visibility.
AppSec friction is now an operating-model problem, not a tooling problem. The article’s strongest signal is that teams are not simply short on scanners or alerts. They are short on mechanisms that can translate findings into immediate developer-facing action, policy enforcement, and risk prioritisation. That is why the debate is shifting toward embedded, context-aware controls rather than bolt-on review layers. The practitioner conclusion is to redesign workflow ownership before adding more findings.
Context-aware agents will matter most where human review cannot scale. The article points to a future where security systems do more than observe, but that future only works if the agent is constrained by policy, auditability, and clear task scope. In governance terms, this is the difference between machine-assisted remediation and uncontrolled automation. Teams should treat agent design as part of AppSec architecture, not as a productivity feature.
Security teams must stop treating developer velocity as a secondary variable. The article makes clear that faster code production changes the economics of review, remediation, and governance. When velocity outruns control capacity, organisations accumulate hidden risk even when their tools are technically working. The practical conclusion is that security programme success should be measured by whether controls keep pace with AI-assisted delivery, not by scan volume alone.
From our research library:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
- Read next: Agentic AI Identity Maturity Model
What this signals
AI-generated code is creating AppSec drift: when delivery velocity rises faster than review capacity, defects are no longer the only problem, because governance itself starts to lag the code it is supposed to control. That is why the control point has to move upstream into creation, policy execution, and remediation inside the development workflow.
The identity-security angle is indirect but important. As developers rely more on AI assistants to assemble code, the question becomes who, or what, is making the effective security decision at the moment code is written, reviewed, and merged.
The governance shift is already being recognised outside the AppSec niche, with 69% of security leaders agreeing identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That is the same structural problem here: controls designed for slower, human-paced decisions are being asked to govern faster, machine-influenced actions.
For practitioners
- Embed remediation in the developer workflow Place security guidance where developers already work, including pull requests, IDEs, and CI pipelines, so risky patterns can be corrected before merge rather than after release.
- Convert findings into policy-enforced actions Map common AppSec findings to enforceable policy so the control plane can block, rewrite, or route unsafe code paths instead of only creating tickets.
- Prioritise high-friction risk classes first Focus agentic intervention on the friction points the article identifies: speed versus security, policy versus practice, and visibility versus risk posture.
- Measure security outcomes against delivery speed Track whether remediation and policy enforcement are keeping pace with AI-assisted coding volume, not just whether issues are being found.
Key takeaways
- AI-generated code widens AppSec exposure because security review is still organised around a slower, human-paced operating model.
- The main risk is not just more vulnerabilities, but more vulnerabilities that are embedded before traditional controls can react.
- Security teams need controls that can interpret, enforce, and remediate inside the development workflow rather than only observe from outside.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF, OWASP SAMM, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI assistants shaping code and policy create identity and authority questions in agentic workflows. |
| Recommendation — Constrain agent permissions and audit every action that changes code, policy, or remediation state. | ||
| NIST AI RMF | MANAGE — AI Governance and Accountability | The article is about governing AI-assisted development, not just using AI tools. |
| Recommendation — Embed governance, monitoring, and escalation paths into AI-assisted development workflows. | ||
| OWASP SAMM | Governance — Governance | The piece focuses on how software security practices must adapt to AI-accelerated delivery. |
| Recommendation — Update software security governance so AI-assisted coding is assessed inside SDLC practice reviews. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-Rest Confidentiality and Integrity | Insecure generated code can expose or mishandle data once deployed. |
| Recommendation — Protect application data paths by verifying generated code does not weaken confidentiality or integrity controls. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | The article is directly about AppSec operating model gaps in software delivery. |
| Recommendation — Strengthen application security governance so findings become enforced fixes, not dormant tickets. | ||
Key terms
- AI-generated code: Software produced wholly or partly by an AI model or agent rather than a human developer. The security concern is not authorship alone, but whether the resulting logic, access control, and dependency choices have been independently verified before release.
- Vibe Coding: A software development approach where natural-language prompts drive much of the implementation and AI produces the code. In practice, the term covers a wide range of control levels, from no-review prototyping to structured engineering with tests, review, and architecture held by humans.
- Agentic Intervention: The use of software agents to take governed action, not just raise alerts, within a security or development workflow. In AppSec, this means interpreting findings, enforcing policy, or proposing fixes in context, while staying within auditable boundaries.
- AppSec Operating Model: The operating structure that determines how application security teams discover issues, prioritise risk, assign ownership, and drive remediation. When development is AI-accelerated, the operating model must shift from passive review to embedded, workflow-aware control.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course if your programme needs a stronger governance model for machine-assisted decisions and access.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org