Notifications
Clear all
Topic starter
02/08/2026 12:22 pm
TL;DR: AI-assisted coding is accelerating delivery while introducing insecure logic, hidden dependencies, and hard-coded secrets faster than post-commit scanning can catch them, according to Checkmarx and Gartner. Security teams now need preventative, context-aware controls at the point of code generation, not after merge, because review latency is no longer aligned with development speed.
NHIMG editorial — based on content published by Checkmarx: The New Reality: AI Is the Fastest Developer on Your Team
By the numbers:
- more than 60% of GenAI code is reused without review
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern AI-assisted code generation in development workflows?
A: Treat AI-assisted code generation as a control point, not just a productivity feature.
Q: Why do AI coding tools increase secrets risk?
A: AI coding tools increase secrets risk because they can accelerate the reuse of insecure patterns across repositories, test fixtures, and automation scripts.
Q: What breaks when AppSec tools only scan after commit?
A: Post-commit scanning misses the moment when a risky change can still be prevented.
Practitioner guidance
- Move security policy into the IDE Enforce checks for risky logic, unsafe API usage, and embedded secrets while code is being written, not after merge.
- Align secrets governance with AI coding workflows Review how API keys, tokens, certificates, and service credentials are introduced through AI-assisted development.
- Require auditable agent decisions Log every automated block, warning, and remediation action with the policy reason, context, and outcome.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- Three-agent workflow details showing how Developer Assist, Policy Assist, and Insights Assist separate enforcement, governance, and telemetry.
- Examples of IDE, CI/CD, and package-manager integration across VS Code, JetBrains, Cursor, Windsurf, GitHub, GitLab, Jenkins, npm, Maven, and PyPI.
- The article's framing of AppGenSec and ACSA as two sides of the same shift in AI-enabled software security.
- Board-facing metric categories such as MTTR, SLA adherence, and exposure reduction that the source says are important for AppSec reporting.
👉 Read Checkmarx's analysis of AI code security assistance and AppSec →
AI code security assistance in the IDE: are your controls ready?
Explore further
02/08/2026 1:22 pm
AI-assisted development creates a policy-enforcement gap at the point of creation. AppSec teams have long relied on post-commit controls, but AI-generated code compresses the decision window so aggressively that detection alone no longer matches the risk. The named concept here is generation-time governance: controls must act while code is being composed, not only after it is stored. That is especially relevant where AI code helpers can surface secrets, unsafe APIs, or identity-bearing automation paths. Practitioner implication: security policy has to move into the developer workflow itself.
A question worth separating out:
Q: How can security teams tell whether AI lifecycle controls are working?
A: They should look for evidence that access requests, policy enforcement, and usage visibility are centrally recorded and current. If those signals are fragmented across platforms, the programme may be documenting governance rather than enforcing it. Continuous traceability is the practical test.
👉 Read our full editorial: AI code security assistance is shifting AppSec to the IDE
