Notifications
Clear all
Topic starter
02/08/2026 12:15 pm
TL;DR: Nearly every one of 1,500 AppSec leaders surveyed reported breaches tied to vulnerable code, while less than one in five organisations have governance policies for autonomous code, according to Checkmarx. The shift from code scanning to continuous, agentic intelligence makes software security a governance and validation problem, not just a detection problem.
NHIMG editorial — based on content published by Checkmarx: 2026 predictions for agentic AI AppSec leadership
By the numbers:
- Nearly every one of the 1,500 AppSec leaders it surveyed reported breaches tied to vulnerable code.
- 2026., than one in five organizations even have governance policies in place to manage the coming wave of autonomous code in 2026.
- Anthropic reported a largely autonomous AI-led espionage campaign against 30 organizations.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI coding agents increase supply-chain risk?
A: AI coding agents can choose tooling, install packages, and edit lock files in ways that may bypass the controls humans expect in a managed environment.
Q: What breaks when static analysis is used as the main AppSec control for AI code?
A: Static analysis breaks down when it is treated as the primary control for AI code because it cannot fully explain context, runtime behaviour, or why a generated change is risky in production.
Practitioner guidance
- Establish provenance controls for AI-generated code Require traceability for machine-authored changes in the IDE, pull request, and build pipeline so reviewers can distinguish human decisions from generated output.
- Constrain automation identities in the SDLC Inventory CI/CD service accounts, pipeline tokens, and AI tool credentials, then apply least privilege, short-lived access, and explicit rotation to each one.
- Add policy gates before agentic remediation Define which findings an agent may triage, suppress, or fix automatically, and require approval for any action that changes code, permissions, or release state.
What's in the full article
Checkmarx's full post covers the operational detail this post intentionally leaves for the source:
- How the vendor expects agentic AppSec to sit inside IDEs and pull-request workflows
- Examples of AI-assisted remediation, prioritisation, and orchestration across the SDLC
- The vendor's view of static analysis, dynamic analysis, and runtime SCA in AI-heavy pipelines
- Predictions on how security and developer workflows may change as AI-generated code scales
👉 Read Checkmarx's 2026 AppSec predictions for agentic AI and secure code →
AI-generated code and agentic AppSec: are your controls keeping up?
Explore further
02/08/2026 1:17 pm
AI-driven AppSec is becoming a governance discipline, not just a testing discipline. The article's central claim is that code velocity is now outrunning traditional review and remediation loops. That is not simply a tooling issue. It means organisations need policy, provenance, and accountability models that can keep up with machine-generated change. For practitioners, the implication is clear: security must be measured by control integrity across the SDLC, not by scan volume.
A question worth separating out:
Q: Who is accountable when an autonomous security agent changes a release?
A: Accountability belongs to the team that defines the agent's permissions, approvals, and rollback rules. If an autonomous security system can alter code or release state, governance must specify who authorised that capability, what actions are allowed, and how those actions are audited. Without that, the organisation has delegated control without delegated responsibility.
👉 Read our full editorial: AI-driven AppSec in 2026 is a governance problem, not just scanning
