Notifications
Clear all
Topic starter
28/08/2026 12:04 pm
TL;DR: Healthcare teams are facing a widening gap as AI coding agents can generate code about 5x faster while review, SAST, and secrets scanning still operate at human pace, according to Apiiro. IBM data cited in the article shows 97% of AI-related breaches hit organisations without proper AI access controls, which makes write-time prevention the decisive control point.
NHIMG editorial — based on content published by Apiiro: AI coding agents, write-time prevention, and healthcare code risk
By the numbers:
- Healthcare breaches cost an average of $7.42 million and take 279 days to find and contain, longer than any other sector.
- AI-related breaches hit 97% of organisations without proper AI access controls, according to IBM.
Questions worth separating out
Q: What breaks when organisations rely only on post-commit scanning for AI code?
A: Post-commit scanning breaks when the security decision happens too late.
Q: Why do AI coding assistants create access control risk in applications?
A: Because they often generate code that assumes the caller is trusted or that sensitive fields are safe to expose.
Q: How do security teams know if write-time prevention is working?
A: Look for a drop in risky patterns reaching source control, fewer late-stage remediation cycles, and a shorter window between prompt and safe output.
Practitioner guidance
- Shift security controls into the generation path Evaluate whether risky code can be blocked or rewritten before commit, rather than only detected after SAST or dependency scanning.
- Classify AI coding agents as governed systems Assign explicit ownership, policy boundaries, and auditability to coding agents that can touch source, APIs, and sensitive data.
- Ground prompt controls in live repository context Connect generation-time policy to the software graph, sensitive routes, and data classifications so controls change by application and environment.
What's in the full article
Apiiro's full article covers the operational proof of concept and implementation detail this post intentionally leaves for the source:
- Step-by-step breakdown of how Secure Prompt enriches developer prompts using software graph and risk graph context.
- The full proof-of-concept workflow showing the same prompts used with and without prevention controls in a healthcare codebase.
- Detailed sample policy injections for YAML deserialisation, authentication, authorisation, input validation, logging, and PII handling.
- Operational ROI calculations behind the estimated $15M yearly savings claim, including how triage and fix cost were modelled.
👉 Read Apiiro's proof of concept on preventing AI-generated code risk in healthcare →
AI coding agents in healthcare: where do code review controls fail?
Explore further
28/08/2026 12:04 pm
AI code generation creates a governance gap before a vulnerability exists. The article’s central point is that security teams are still orienting themselves around code review, but AI agents can create vulnerable patterns faster than those controls can inspect them. That turns prevention into a policy and identity problem because the real decision is who or what can generate code that touches sensitive data. Practitioners should treat code generation as a governed action, not a neutral productivity event.
A question worth separating out:
Q: Should organisations treat AI coding agents as part of IAM and PAM governance?
A: Yes, when those agents can act on code, data, or tools in ways that affect production risk. Their permissions should be scoped, reviewed, and audited like other privileged systems, especially when they interact with sensitive routes, secrets, or regulated data. The governance question is who can let the agent act, and under what policy.
👉 Read our full editorial: AI coding agents are outpacing healthcare code review controls
