Notifications
Clear all
Topic starter
02/08/2026 12:31 pm
TL;DR: AI-accelerated development is widening AppSec gaps because 76% of AI-generated code still needs security refactoring and developer productivity gains are outpacing review capacity, according to Checkmarx, IDC and The New Stack. The security model now has to move from passive finding to context-aware action, or risk will accumulate faster than teams can remediate it.
NHIMG editorial — based on content published by Checkmarx: Checkmarx Targets DevSecOps Friction Points with AI Agents for Code, Policy, and Risk
By the numbers:
- Developers using GenAI tools like GitHub Copilot are reporting 35% productivity gains, according to IDC’s 2024 Generative AI Study.
- 76% of AI-generated code requires security refactoring, according to The New Stack’s 2025 State of Web Dev AI Report.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale.
Q: What do teams get wrong when they evaluate AI support in AppSec tools?
A: They often confuse usability features with security capability.
Practitioner guidance
- Treat generated code as a governed input Require AI-assisted code to pass the same policy checks as human-authored code, with additional review for dependencies, secrets, and privilege-related changes.
- Shift AppSec from detection to controlled intervention Automate low-risk fixes, policy standardisation, and risk routing inside the developer workflow so teams reduce backlog without abandoning oversight.
- Add secrets and NHI controls to AI coding workflows Scan for embedded credentials, enforce service-account ownership, and verify that generated code cannot introduce unmanaged tokens or hardcoded secrets.
What's in the full article
Checkmarx's full commentary covers the operational detail this post intentionally leaves for the source:
- How the Developer Assist, Policy Assist, and Insights Assist agents are intended to fit into AppSec workflows.
- The IDC framing behind friction between security and speed, policy and practice, and risk posture and visibility.
- The implementation context for embedding controls inside developer tools rather than adding another downstream review layer.
- The specific enterprise outcomes IDC associates with auditability, policy standardisation, and remediation speed.
👉 Read Checkmarx's commentary on AI-generated code, AppSec friction, and agentic controls →
AI-generated code and AppSec friction: are current controls enough?
Explore further
02/08/2026 1:29 pm
AI-generated code has become an AppSec governance problem, not just a developer productivity issue. When AI systems can produce, refactor, and recommend code at scale, the control question shifts from code review depth to governance of the generation workflow itself. That creates a new boundary between secure software delivery and machine-assisted authorship. Practitioners should treat generated code as a governed input, not a trusted output.
A question worth separating out:
Q: How can organisations tell whether their AI security model is actually working?
A: They should test whether the control stack can explain who acted, what data was touched, and what purpose the action served. If those three signals cannot be correlated in one incident view, the model is likely monitoring access without governing behaviour. That is a visibility gap, not a complete AI security posture.
👉 Read our full editorial: AI-generated code is breaking legacy AppSec operating models
