Notifications
Clear all
Topic starter
02/08/2026 11:58 am
TL;DR: AI coding assistants are accelerating code creation faster than traditional AppSec workflows can absorb, and the article argues that AI-native detection, remediation, and governance now need to span the IDE, supply chain, and runtime, according to Checkmarx. The real shift is that security must govern AI-generated code as an ecosystem, not just scan a file after commit.
NHIMG editorial — based on content published by Checkmarx: Claude Code Security and the case for agentic application security
Questions worth separating out
Q: How should security teams govern autonomous coding agents in software delivery pipelines?
A: Treat the agent, its sandbox, and its tool access as a single governed execution path.
Q: Why do AI coding tools change the risk profile for developer platforms?
A: AI coding tools change the risk profile because they compress the path from intent to code, then from code to deployment.
Q: What breaks when AppSec tools only scan after commit?
A: Post-commit scanning misses the moment when a risky change can still be prevented.
Practitioner guidance
- Define governance for AI coding agents Inventory every AI coding assistant, IDE extension, and remediation workflow that can change source code or security policy.
- Scope remediation agents as governed NHIs Give automated remediation systems the minimum privileges needed to propose or apply fixes, and require logging for every change they make.
- Push controls left into the IDE Use pre-commit and in-IDE checks for secrets, malicious packages, IaC misconfigurations, and high-risk code patterns so security feedback arrives before merge, not after release.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- IDE-specific coverage across Cursor, Windsurf, VSCode, AWS Kiro, and JetBrains environments.
- The platform-level breakdown of SAST, SCA, secrets, IaC, and container risk handling in one workflow.
- How Safe Refactor is positioned to validate whether a fix introduces regressions or build breakage.
- The post's discussion of compliance reporting, auditability, and enterprise-scale governance across the AI supply chain.
👉 Read Checkmarx's analysis of Claude Code Security and agentic AppSec →
AI coding risk and agentic AppSec: are your controls keeping up?
Explore further
02/08/2026 1:06 pm
AI coding is becoming an identity governance problem, not just an AppSec problem. Once code generation, triage, and remediation are mediated by software actors, security teams are no longer governing only human developers. They are governing the privileges, constraints, and auditability of non-human workflows that can change code at scale. That makes machine identity, access scope, and change attribution central to the control model.
A question worth separating out:
Q: How can organisations tell whether hybrid AppSec is working?
A: A hybrid AppSec programme is working when model-assisted discovery consistently feeds deterministic validation and measurable remediation outcomes. Look for fewer false positives, shorter verification cycles, and better alignment between exploitability and priority. If AI output is fast but still produces noisy backlog inflation, the model is not improving control quality.
👉 Read our full editorial: AI coding risk is forcing agentic AppSec beyond static scanning
