Notifications
Clear all
Topic starter
02/08/2026 11:57 am
TL;DR: AI coding tools are accelerating feature delivery while also widening the gap between what compiles and what is secure, according to Checkmarx. The practical issue is not developer intent but security validation speed, because AI-assisted workflows increase code volume, dependency complexity, and backlog pressure faster than AppSec teams can review them.
NHIMG editorial — based on content published by Checkmarx: AI coding tools have fundamentally changed how software gets built
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI-assisted workflows create hidden application security risk?
A: AI-assisted workflows create hidden risk because they expand the number of systems, dependencies, and trust relationships involved in producing code.
Q: What do AppSec teams get wrong about code that compiles successfully?
A: Teams often confuse functional correctness with security assurance.
Practitioner guidance
- Inventory AI-assisted development paths Map where AI code generation, agentic workflows, model integrations, and MCP connections are already in use across delivery teams.
- Shift validation from syntax to exploitability Add security checks that evaluate whether generated code can be abused in the target environment, not only whether it compiles or passes tests.
- Automate triage for high-volume findings Use deterministic analysis and context-aware prioritisation to reduce noise in large AppSec queues.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor frames agentic scanning for high-volume AppSec triage and remediation.
- The specific role of AI-BOMs in tracking models, connections, and data flows across development environments.
- How Checkmarx positions deterministic analysis alongside AI-driven detection inside the delivery pipeline.
- The vendor's description of Developer Assist and how it fits into workflow automation.
👉 Read Checkmarx's analysis of AI-generated code risk in AppSec →
AI-generated code and AppSec: are your controls keeping up?
Explore further
02/08/2026 1:05 pm
AI-generated code has created a confidence gap, not just a speed problem. The core risk is that output quality makes code feel trustworthy before security validation has happened. That shifts the burden onto AppSec teams to detect exploitability at machine speed, not merely react after merge. In identity terms, this is also a governance issue because AI-assisted workflows are now part of the trust chain that determines what enters production.
A question worth separating out:
Q: How should organisations respond when backlog growth outpaces AppSec review capacity?
A: They should automate triage, prioritise findings by exposure and exploitability, and push security controls earlier into the delivery workflow. If backlog growth is sustained, it is a sign that governance is lagging behind the development model. Leaders should measure whether findings are being resolved before code reaches production, not just whether they are being logged.
👉 Read our full editorial: AI-generated code is widening the AppSec confidence gap
