Topic starter
01/08/2026 8:56 pm
TL;DR: AI-generated code still passes security checks only 56% of the time, with Veracode linking the shortfall to code generation that introduces vulnerabilities in 44% of tasks. Verification and remediation have to catch up before generated output scales past review capacity.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “2026 GenAI Code Security Report: AI Is Writing More of Your Code but Security Hasn’t Caught Up”.
By the numbers:
- The average security pass rate across models is 56%, barely changed from 55% in the first report.
Key questions
Q: Why do AI coding tools change the AppSec bottleneck?
A: They increase code output faster than human reviewers can provide context, judgment, and validation.
Q: How can security teams tell whether AI-generated code is actually safe?
A: They should look for security regression evidence, not just test pass rates.
Q: What breaks when AI coding tools are trusted without strong verification?
A: What breaks first is consistency.
Practitioner guidance
- Set security thresholds for AI coding models Require model selection criteria to include security pass rates by weakness class, not only output quality or developer preference.
- Move verification into the development workflow Run security checks at generation time and before merge so vulnerable output is caught while context is still available to the developer.
- Prioritise the weakest vulnerability classes first Tune review depth and testing emphasis toward the flaw types that remain hardest for models to avoid, especially where the article shows the pass rate falls sharply.
Bottom line: AI-assisted development is now large enough that security governance can no longer treat generated code as an edge case.
Glossary terms: GenAI Code Security, Security Pass Rate, Verification in the Workflow, Model Selection For Security Tasks
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
01/08/2026 9:04 pm
GenAI code security is now a throughput governance problem. Once AI authors a large share of committed code, the limiting factor stops being generation and becomes verification capacity. Security programmes that still assume human-paced review are structurally out of alignment with the delivery model. The practitioner conclusion is straightforward: governance must move upstream with the code, not trail behind it.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations standardise on one AI coding model or allow teams to choose?
A: Standardisation can reduce governance complexity, but only if the selected model has demonstrably better security performance for the code patterns the organisation uses. Otherwise, local choice may outperform central policy on risk. The decision should be based on measured vulnerability rates, not on developer familiarity or output style alone.
👉 Read our full editorial: GenAI code security is a scale problem, not a syntax problem