Topic starter
02/08/2026 12:15 pm
TL;DR: Nearly every one of 1,500 AppSec leaders surveyed reported breaches tied to vulnerable code, while less than one in five organisations have governance policies for autonomous code, according to Checkmarx. The shift from code scanning to continuous, agentic intelligence makes software security a governance and validation problem, not just a detection problem.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Checkmarx Influencer 2026 Predictions”.
By the numbers:
- Nearly every one of the 1,500 AppSec leaders surveyed reported breaches tied to vulnerable code.
- Less than one in five organisations have governance policies in place to manage autonomous code in 2026.
Key questions
Q: What breaks when AI generated code is secured only with traditional static scanning?
A: Traditional static scanning often produces too much noise and too little context for AI generated code.
Q: Why does AI-assisted development create a governance problem beyond code quality?
A: AI-assisted development changes who creates code, how fast it moves, and how difficult it is to trace.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Define governance for AI-generated code Require teams to label machine-generated changes, record the source workflow, and route them through policy checks before merge.
- Add provenance checks to the SDLC Verify where code came from, which model or assistant influenced it, and whether the build path preserves integrity from commit to artefact.
- Correlate findings across static, dynamic, and runtime controls Use one triage path that connects SAST, DAST, SCA, and runtime signals so risky generated code is handled in context.
Bottom line: AI-generated code increases the burden on AppSec because teams must validate provenance and policy alignment, not just find defects after the fact.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:17 pm
AI-generated code governance is now a control problem, not a tooling problem. The article describes a world where code output outpaces human review and where provenance matters as much as vulnerability detection. That changes the centre of gravity from scan coverage to governed software production. Practitioners should treat machine-generated code as a policy-bound asset with lifecycle controls, not just as another source of findings.
A question worth separating out:
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk. Require architectural review, test coverage, static analysis, and approval before merge. Then bind the agent and the build pipeline to least privilege, short-lived credentials, and complete audit logging so implementation speed does not outrun control.
👉 Read our full editorial: AI-driven AppSec in 2026 is a governance problem, not just scanning