Topic starter
01/08/2026 8:56 pm
TL;DR: As AI now authors roughly half of committed code in adopted environments, Veracode reports that 44% of code-generation tasks still introduce vulnerabilities and the average security pass rate remains 56%, showing that secure output has not improved at the pace of adoption. The operational problem is no longer whether AI can write code, but whether verification, remediation, and governance can keep up.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “2026 GenAI Code Security Report: AI Is Writing More of Your Code but Security Hasn’t Caught Up”.
By the numbers:
- The average security pass rate across models is 56%, barely changed from 55% in the first report.
Key questions
Q: What breaks when AI coding tools are trusted without strong verification?
A: What breaks first is consistency.
Q: Why do AI coding tools change the AppSec bottleneck?
A: They increase code output faster than human reviewers can provide context, judgment, and validation.
Q: How can security teams tell whether AI-generated code is actually safe?
A: They should look for security regression evidence, not just test pass rates.
Practitioner guidance
- Set security thresholds for AI coding models Require model selection criteria to include security pass rates by weakness class, not only output quality or developer preference.
- Move verification into the development workflow Run security checks at generation time and before merge so vulnerable output is caught while context is still available to the developer.
- Prioritise the weakest vulnerability classes first Tune review depth and testing emphasis toward the flaw types that remain hardest for models to avoid, especially where the article shows the pass rate falls sharply.
Bottom line: AI-assisted development is now large enough that security governance can no longer treat generated code as an edge case.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:04 pm
GenAI code security is now a throughput governance problem. Once AI authors a large share of committed code, the limiting factor stops being generation and becomes verification capacity. Security programmes that still assume human-paced review are structurally out of alignment with the delivery model. The practitioner conclusion is straightforward: governance must move upstream with the code, not trail behind it.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations standardise on one AI coding model or allow teams to choose?
A: Standardisation can reduce governance complexity, but only if the selected model has demonstrably better security performance for the code patterns the organisation uses. Otherwise, local choice may outperform central policy on risk. The decision should be based on measured vulnerability rates, not on developer familiarity or output style alone.
👉 Read our full editorial: GenAI code security is a scale problem, not a syntax problem