Topic starter
19/08/2026 3:33 pm
TL;DR: AI is changing both how software is built and what software contains, with Legit Security reporting that 81% of developers use AI coding assistants, 96% of security and development professionals see GenAI in application delivery, and Gartner expects 40% of new enterprise production software to use vibe coding by 2028. The security challenge is no longer just code review; it is governing AI-assisted development, AI-in-the-stack applications, and the new trust boundaries they create.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “How AI Is Changing the Software Development Process, and Product”.
By the numbers:
- 81% of developers surveyed reported using AI-powered coding assistants.
- 96% of security and software development professionals report that their companies use GenAI-based solutions for building or delivering applications.
- 88% of developers surveyed report using AI coding assistants.
Key questions
Q: How should security teams implement AI code generation controls in the SDLC?
A: Start at the point of generation, not at the point of release.
Q: Why does vibe coding increase application security risk?
A: Because it increases the volume and speed of code changes faster than traditional review and scanning can absorb.
Q: What breaks when AI agents can generate code but cannot validate, test, or correct it end to end?
A: When agents can only generate code, teams often get incomplete output that still needs manual cleanup, integration work, and debugging.
Practitioner guidance
- Establish prompt-to-production governance Define controls for AI-assisted coding that cover prompt approval, generated output review, dependency validation and release authorization.
- Constrain agent permissions in delivery pipelines Limit what coding agents can read, write, test and deploy, and log every tool action they take across repositories and CI/CD.
- Require provenance for AI-generated changes Track which changes were produced by assistants or agents, then attach that provenance to code review and release records.
Bottom line: AI-generated code changes application security by altering both how software is produced and what software now contains.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:15 pm
AI-generated code creates governance debt, not just code volume. The central issue is that security teams inherit more software, more quickly, while also inheriting uncertainty about how much of it was machine-generated and how much human review it received. That weakens traditional assurance models that depend on authorship, manual inspection and stable change windows. Practitioners should treat AI-generated code as a governance problem that spans AppSec, SDLC control and identity-aware access to development systems.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How do AppSec and IAM work together for AI-in-the-stack software?
A: AppSec defines what the software should and should not do, while IAM governs which non-human actors can create, modify or exercise those capabilities during development and runtime. When AI becomes part of the stack, the two disciplines need a shared view of tool access, data access and release authority.
👉 Read our full editorial: AI-generated code is reshaping AppSec and software trust models