Topic starter
02/08/2026 12:20 pm
TL;DR: 81% of organisations knowingly ship vulnerable code, 54% of code is AI-generated, and 98% experienced a breach in the past year, according to Checkmarx’s panel and 2026 outlook report, underscoring how speed, shadow AI, and weak measurement are reshaping application security. The real issue is governance: security programmes now have to prove what is actually shipping, not just count findings.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: ““Vulnerable by Design”: The Boldest Takes From Our Live Panel on AppSec in the Agentic AI Era”.
By the numbers:
- 81% of organisations knowingly ship vulnerable code, according to Checkmarx.
- 54% of all code is now AI-generated, often without governance, according to Checkmarx.
- 98% experienced a breach in the past year, according to Checkmarx.
Key questions
Q: Where does AI-generated code fail in practice when teams lack governance?
A: It fails when teams can no longer tell which code paths were model-assisted, who approved the tool, or what data the tool could reach.
A: A high alert count does not prove stronger security if teams cannot distinguish exploitable issues from low-value noise.
Q: What are the signs that shadow AI is creating governance and compliance gaps?
A: Common signs include limited visibility into who is using AI tools, no reliable audit trail for prompts and outputs, unclear data residency, and inconsistent handling of sensitive information.
Practitioner guidance
- Define policy for AI-assisted code creation Publish a formal rule set for when AI coding tools may be used, what data they can access, and how generated code must be reviewed before merge.
- Shift reporting from counts to risk Replace raw vulnerability totals with measures that show exploitability, business context, ownership, and whether risky code was accepted or remediated.
- Gate production on verified testing evidence Require test results, provenance checks, and approval evidence before code can move from repository to deployment, especially when AI helped generate it.
Bottom line: AI-assisted development is widening the gap between code creation and code trust, which makes governance and evidence more important than scan volume.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:21 pm
AI-generated code has turned AppSec into a governance discipline, not a tooling contest. The article shows that the central failure is no longer whether scanners exist, but whether organisations can prove what was generated, reviewed, and accepted. That pushes AppSec closer to policy enforcement, release governance, and evidence collection than to point-in-time vulnerability discovery. Practitioners should treat AI-assisted development as a control design problem.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Treat application security as a shared engineering responsibility, not a security-team handoff. The most effective approach is to align incentives, use tools that help developers fix issues quickly, and create clear collaboration paths between engineering and security. When teams understand each other’s pressures and can resolve problems early, product security improves without adding avoidable friction.
👉 Read our full editorial: AI-driven AppSec is exposing a governance gap in secure code delivery