Notifications
Clear all
Topic starter
20/08/2026 6:05 pm
TL;DR: AI coding assistants are already used or piloted by 97% of organisations, yet only 19% say they have full visibility into where AI is used, according to Cycode's State of Product Security in the AI Era report. The gap is shifting product security from point controls to governance, inventory, and consolidated oversight as AI-generated code and Shadow AI expand faster than review processes.
NHIMG editorial — based on content published by Cycode: When AI Outpaces Security: What Our New Research Reveals About the Future of Product Security
By the numbers:
- 97% of organizations are already using or piloting AI coding assistants.
- Only 19% have full visibility into where and how AI is used.
- 52% of organizations admit they lack a centralized framework to manage AI adoption.
Questions worth separating out
Q: What breaks when AI adoption outpaces governance?
A: What breaks first is attribution.
Q: Why do AI coding assistants create new security review risks?
A: They can produce code that looks correct but still contains weak authentication, unsafe data flows, or hidden secret handling mistakes.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Build a complete AI asset inventory Catalog approved and unapproved models, copilots, plugins, and MCP connections across development, testing, and release environments.
- Gate AI-generated code on provenance checks Require review, attribution, and traceability for code produced by AI systems before it enters build or deployment pipelines.
- Consolidate AI approval into one control plane Move tool approval, data-access rules, exception handling, and periodic review into a single governance process.
What's in the full report
Cycode's full report covers the operational detail this post intentionally leaves for the source:
- The full survey methodology behind the 97% adoption and 19% visibility findings.
- Breakdowns of how security and product teams are structuring AI governance in practice.
- Detailed examples of Shadow AI detection and AI/ML inventory approaches across the SDLC.
- The report's broader benchmark data on consolidation, budgets, and response priorities.
👉 Read Cycode's State of Product Security in the AI Era report on AI visibility and governance →
AI-generated code and Shadow AI: what security teams are missing?
Explore further
20/08/2026 6:40 pm
Shadow AI is becoming a governance category, not just an adoption problem. Organisations are no longer dealing with isolated experimentation when AI tools, plugins, and code assistants spread across teams. The missing control is centralised policy over tool approval, data access, and output handling. Without that, security cannot answer the basic question of what AI is doing inside the SDLC, which makes the environment ungovernable rather than merely risky.
A question worth separating out:
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact. Require human approval, traceable authorship, scoped workload identities, and evidence of intent before production promotion. The goal is to preserve provenance and limit blast radius when generated logic behaves unexpectedly.
👉 Read our full editorial: AI adoption is outpacing product security visibility and governance
