Notifications
Clear all
Topic starter
02/08/2026 11:48 am
TL;DR: In a 450-leader survey across Europe and the US, 69% of organisations said AI-generated code introduced vulnerabilities, one in five reported a serious security incident tied to it, and only 21% believed AI will ever write secure code without human oversight, according to Aikido. The finding is less about code quality alone than about governance lag, tool sprawl, and fragile accountability in development workflows.
NHIMG editorial — based on content published by Aikido: 2026 State of AI in Security & Development
By the numbers:
- 69% of organizations found vulnerabilities introduced by AI-generated code
- 1 in 5 experienced a serious security incident linked to it
- Only 21% believe AI will ever write secure code without human oversight
Questions worth separating out
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: Why do more security tools sometimes increase incident risk?
A: Because more tools often create more queues, more false positives, and more handoffs.
Q: What breaks when developer experience is poor in AppSec?
A: Poor developer experience breaks compliance behaviour.
Practitioner guidance
- Separate AI-assisted code paths from standard review workflows Tag AI-generated or AI-assisted commits so they receive targeted testing, higher-risk review, and stronger dependency checks before merge.
- Collapse duplicate security tooling into fewer decision points Inventory scanners, policy gates, and ticket queues that serve the same purpose, then remove overlaps that create delayed triage and repeated false positives.
- Measure remediation time, not tool count Track how long it takes to move from finding to fix, then compare that with the number of controls in the path.
What's in the full report
Aikido's full report covers the operational detail this post intentionally leaves for the source:
- Breakdowns by role group across 450 security leaders, developers, and AppSec engineers so you can compare your own operating model.
- The report’s practitioner commentary on how AI-generated code, false positives, and incident response interact in real development teams.
- Examples of how security teams can reduce noise without slowing engineering delivery, which is more useful at implementation stage than high-level trend data.
- The report’s summary of what leading teams do differently when tool sprawl starts affecting incident rates.
👉 Read Aikido's 2026 State of AI in Security & Development report →
AI-generated code and AppSec risk: are your controls keeping up?
Explore further
02/08/2026 12:58 pm
AI-generated code has become an AppSec governance problem, not just a coding efficiency issue. The report shows that vulnerability introduction is now a measurable outcome of AI-assisted development, not a theoretical concern. That changes the unit of control from individual developer judgement to policy, review depth, and workflow assurance. Practitioners should treat AI-generated code as a governed input to the software supply chain, not as a neutral productivity aid.
A question worth separating out:
Q: Who should own policy for AI coding agents in production?
A: Policy ownership should sit with platform security, IAM, or a dedicated security engineering team, not with individual developers. The reason is accountability: the same team that governs privileged human access should also govern agent tool use, version policy, review audit logs, and approve exceptions. That keeps the authorization model consistent across identities.
👉 Read our full editorial: AI-generated code is widening AppSec risk faster than controls
