Topic starter
02/08/2026 12:20 pm
TL;DR: AI-assisted delivery is widening the gap between code creation and code trust, according to Checkmarx. Application security now has to prove what was approved and shipped, or risk losing accountability as AI use spreads through the pipeline.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: ““Vulnerable by Design”: The Boldest Takes From Our Live Panel on AppSec in the Agentic AI Era”.
By the numbers:
- 81% of organisations knowingly ship vulnerable code, according to Checkmarx.
- 54% of all code is now AI-generated, often without governance, according to Checkmarx.
- 98% experienced a breach in the past year, according to Checkmarx.
Key questions
A: A high alert count does not prove stronger security if teams cannot distinguish exploitable issues from low-value noise.
Q: What are the signs that shadow AI is creating governance and compliance gaps?
A: Common signs include limited visibility into who is using AI tools, no reliable audit trail for prompts and outputs, unclear data residency, and inconsistent handling of sensitive information.
Q: Where does AI-generated code fail in practice when teams lack governance?
A: It fails when teams can no longer tell which code paths were model-assisted, who approved the tool, or what data the tool could reach.
Practitioner guidance
- Define policy for AI-assisted code creation Publish a formal rule set for when AI coding tools may be used, what data they can access, and how generated code must be reviewed before merge.
- Shift reporting from counts to risk Replace raw vulnerability totals with measures that show exploitability, business context, ownership, and whether risky code was accepted or remediated.
- Gate production on verified testing evidence Require test results, provenance checks, and approval evidence before code can move from repository to deployment, especially when AI helped generate it.
Bottom line: AI-assisted development is widening the gap between code creation and code trust, which makes governance and evidence more important than scan volume.
Glossary terms: Shadow AI, AI-generated code, AppSec governance, Provenance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:21 pm
AI-generated code has turned AppSec into a governance discipline, not a tooling contest. The article shows that the central failure is no longer whether scanners exist, but whether organisations can prove what was generated, reviewed, and accepted. That pushes AppSec closer to policy enforcement, release governance, and evidence collection than to point-in-time vulnerability discovery. Practitioners should treat AI-assisted development as a control design problem.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Treat application security as a shared engineering responsibility, not a security-team handoff. The most effective approach is to align incentives, use tools that help developers fix issues quickly, and create clear collaboration paths between engineering and security. When teams understand each other’s pressures and can resolve problems early, product security improves without adding avoidable friction.
👉 Read our full editorial: AI-driven AppSec is exposing a governance gap in secure code delivery