Topic starter
02/08/2026 12:31 pm
TL;DR: AI-accelerated development is widening AppSec gaps because 76% of AI-generated code still needs security refactoring and developer productivity gains are outpacing review capacity, according to Checkmarx, IDC and The New Stack. The security model now has to move from passive finding to context-aware action, or risk will accumulate faster than teams can remediate it.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “IDC Commentary on AI-Assisted Development is a Wake-Up Call for AppSec Leaders”.
By the numbers:
- Developers using GenAI tools like GitHub Copilot are reporting 35% productivity gains, according to IDC research cited by Checkmarx.
- 76% of AI-generated code requires security refactoring, according to The New Stack research cited by Checkmarx.
Key questions
Q: How should security teams manage AppSec when AI is writing code faster than humans can review it?
A: Teams should shift from discovery-centric reporting to remediation-centric governance.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale.
Q: What do organisations get wrong about scanning AI-generated code?
A: The common mistake is treating more scanning as a complete answer.
Practitioner guidance
- Embed remediation in the developer workflow Place security guidance where developers already work, including pull requests, IDEs, and CI pipelines, so risky patterns can be corrected before merge rather than after release.
- Convert findings into policy-enforced actions Map common AppSec findings to enforceable policy so the control plane can block, rewrite, or route unsafe code paths instead of only creating tickets.
- Prioritise high-friction risk classes first Focus agentic intervention on the friction points the article identifies: speed versus security, policy versus practice, and visibility versus risk posture.
Bottom line: AI-generated code widens AppSec exposure because security review is still organised around a slower, human-paced operating model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:29 pm
AI-generated code is forcing AppSec to move from defect detection to governed intervention. Traditional application security assumes code can be reviewed at a pace that remains meaningful relative to development speed. AI-assisted coding breaks that assumption by increasing output volume and compressing review windows, which means the real control point is now at creation and policy execution. For practitioners, that means AppSec operating models need to be redesigned around actionability, not just visibility.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: How should AppSec teams govern AI agents that assist with coding and policy?
A: Treat them as governed workflow actors with tightly defined permissions, auditability, and task scope. Their value comes from translating findings into action in the developer toolchain, but that only works if their behavior is constrained by policy and monitored like any other security control.
👉 Read our full editorial: AI-generated code is breaking legacy AppSec operating models