Notifications
Clear all
Topic starter
19/08/2026 3:33 pm
TL;DR: AI is changing both how software is built and what software contains, with Legit Security reporting that 81% of developers use AI coding assistants, 96% of security and development professionals see GenAI in application delivery, and Gartner expects 40% of new enterprise production software to use vibe coding by 2028. The security challenge is no longer just code review; it is governing AI-assisted development, AI-in-the-stack applications, and the new trust boundaries they create.
NHIMG editorial — based on content published by LEGIT Security: how AI is transforming software development and application security
By the numbers:
- 81% of developers surveyed reported using AI-powered coding assistants.
- 96% of security and software development professionals report that their companies use GenAI-based solutions for building or delivering applications.
- 40% of new enterprise production software will be created with vibe coding techniques and tools by 2028.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI agents complicate IAM and data security controls?
A: Because the core controls were built for human sessions and file-centric data movement, while agents act continuously, inherit permissions, and reason over data in context.
Q: What breaks when AI coding assistants work in a poorly structured codebase?
A: The assistant loses context, spreads change across the wrong files, and makes it harder for reviewers to understand impact.
Practitioner guidance
- Enforce provenance checks on AI-generated changes Require prompts, model interactions, and generated artifacts to be traceable for high-risk code paths so reviewers can see how the change was produced.
- Scope non-human access for AI agents Assign explicit permissions to AI agents that query data or call tools, then review those permissions as if the agent were a workload identity.
- Add security gates before merge, not just before release Use policy checks, secret scanning, and dependency review at the point where AI-generated code enters source control, because post-build inspection is too late for many failure modes.
What's in the full article
LEGIT Security's full article covers the operational detail this post intentionally leaves for the source:
- Examples of how AI coding assistants change developer workflow and code review expectations
- The reported survey breakdowns on GenAI adoption in application delivery and developer usage
- Gartner's 2028 vibe coding forecast and how the vendor frames its relevance to AppSec
- The article's own view of AI as both a security challenge and a path to more efficient application protection
👉 Read LEGIT Security's analysis of how AI is changing software development and AppSec →
AI-generated code in AppSec: what changes for security teams?
Explore further
19/08/2026 4:15 pm
AI-assisted development creates governance debt faster than it creates code value. The article is right to frame AI as a productivity layer, but the security consequence is accumulation of hidden decision points across prompts, models, and agents. That means classic review gates see only the final artefact, not the generation chain that produced it. The practical conclusion is that AppSec programmes need provenance and policy enforcement that operate before code becomes an approved change.
A question worth separating out:
Q: Should organisations use the same access model for humans and AI agents?
A: No. Human access models are built around stable roles and review cycles, while AI agents often need contextual, task-specific permissions that change quickly. Treating them the same usually leads to over-permissioning or constant exceptions. Organisations should separate identity proof from authorization design and apply resource-level controls for agents.
👉 Read our full editorial: AI-generated code is reshaping AppSec and software trust models
