Topic starter
02/08/2026 12:04 pm
TL;DR: AI-assisted development is collapsing the SDLC’s old pause points, and Checkmarx argues that AppSec controls built for pull requests and release gates no longer keep pace with continuous code generation and refactoring. The practical shift is toward in-line, policy-driven security that operates inside the development loop rather than after it.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Goodbye SDLC, Hello ADLC: How Will AppSec Adapt?”.
Key questions
Q: How should security teams govern AI coding assistants that can execute commands?
A: Treat them as delegated non-human identities with bounded execution authority.
Q: Why do pull request reviews and release gates become less effective in ADLC?
A: Because they assume code will wait long enough for a human checkpoint to matter.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Embed security checks inside the IDE Move policy evaluation into the environment where developers and AI systems create code, so risky patterns are flagged before commit or handoff.
- Replace gate-based review with continuous enforcement Rework AppSec controls so they evaluate every change as it is produced, instead of relying on pull requests, release gates, or centralized queues.
- Add policy context to AI-generated code review Require security tooling to understand surrounding code and intended behaviour, not just isolated snippets or scan results.
Bottom line: AI-assisted development is eroding the old pause points that SDLC-era application security depended on, so review after the fact is losing practical value.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:10 pm
ADLC creates governance debt for AppSec teams that still think in review windows. The old operating model assumed there would always be a stable moment to inspect code before it moved on. In continuous AI-assisted development, that assumption fails because the code may change again before a human ever sees it. The practical conclusion is that AppSec governance must be expressed as continuous control, not episodic approval.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What happens when AppSec enforcement stays manual in a machine-paced development loop?
A: Security becomes an after-the-fact interruption that developers are likely to bypass or ignore. Manual review cannot keep up with continuously changing code, so feedback arrives too late to shape the decision that created the risk. The result is weaker governance and lower developer trust in security controls.
👉 Read our full editorial: ADLC is breaking SDLC-era appsec assumptions