Notifications
Clear all
Topic starter
02/08/2026 11:30 am
TL;DR: AI-generated code passes security checks only 55% of the time across 150+ large language models tested by Veracode, while 45% of AI-generated code contains known vulnerabilities when no guidance is provided. The security case is no longer about whether teams will adopt AI-assisted development, but whether AppSec can move at the same velocity without losing control.
NHIMG editorial — based on content published by Veracode: What Every CISO Needs to Know About AI-Assisted Development
By the numbers:
- 45% of AI-generated code contains known security vulnerabilities when no security guidance is provided.
- 82% of organizations carry security debt, up 11% in one year.
Questions worth separating out
Q: How should security teams control AI-assisted coding without slowing developers down?
A: Put policy into the IDE so security guidance appears during code creation, not after commit.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Move security into the IDE Deploy immediate scanning where developers accept AI suggestions, so risky code is flagged before commit and not after merge.
- Gate generated dependencies with package controls Require automated verification for any library or package suggested by an AI assistant, including transitive dependencies and suspicious package names.
- Align SAST, SCA, and DAST in one workflow Use static analysis for source flaws, composition analysis for imported components, and dynamic testing for runtime behaviour.
What's in the full article
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- Model-by-model security pass rate comparisons across GPT, Gemini, Claude, and reasoning-focused systems
- Examples of how SAST, SCA, and DAST should be layered into AI-assisted development workflows
- Specific remediation guidance for security teams trying to reduce AI-generated vulnerability backlog
- The article's discussion of how security teams can balance developer velocity with AppSec control placement
👉 Read Veracode's analysis of AI-assisted development and AppSec risk →
AI-assisted development and AppSec gaps: what should CISOs do now?
Explore further
02/08/2026 12:45 pm
AI-assisted development creates security debt faster than traditional AppSec can repay it. The core governance problem is not code generation itself, but the mismatch between output velocity and review capacity. When insecure code enters the pipeline at scale, vulnerability management stops being a backlog problem and becomes a throughput problem. That changes the operating model for AppSec, because control placement must move earlier and become continuous. Practitioner conclusion: security programmes should be measured by how quickly they intercept risky output, not by how many issues they count.
A question worth separating out:
Q: How can security teams tell whether AI lifecycle controls are working?
A: They should look for evidence that access requests, policy enforcement, and usage visibility are centrally recorded and current. If those signals are fragmented across platforms, the programme may be documenting governance rather than enforcing it. Continuous traceability is the practical test.
👉 Read our full editorial: AI-assisted development is outpacing AppSec controls
