Topic starter
18/08/2026 3:01 pm
TL;DR: Tool complexity is the top AppSec pain point, and AI is already producing 3 to 4 times more code and 10 times more security findings on average, Apiiro reports. Fix governance now depends on correlating findings and runtime context before an agent changes code.
Editorial analysis by NHI Mgmt Group, based on content published by Apiiro: “Confidence in Agentic Code Fixes is rising – but not without a strong ASPM program”.
By the numbers:
- Developers using AI coding assistants generate 3-4× more code and 10× more security findings on average.
- 30% of enterprise code is already AI-generated.
- 75% of engineers are expected to use AI assistants by 2028.
Key questions
Q: Why do AI-generated code fixes need policy and runtime context?
A: Because a fix is only safe if the system knows how the application behaves, what controls already exist, and which exceptions are formally approved.
Q: What are the signs that automated code remediation is becoming unsafe?
A: Common signals include duplicated findings across tools, repeated suppression of the same issue, fixes that fail in pre-production, and changes that violate architecture or policy intent.
Q: Where does agentic remediation fail when AppSec tools are not coordinated?
A: It fails when individual scanners produce findings without a shared model of code structure, dependencies, and compensating controls.
Practitioner guidance
- Correlate AppSec findings before remediation Unify SAST, SCA, secrets, DAST, and code review outputs into one risk view so automated fixes do not act on duplicate or incomplete alerts.
- Gate agentic fixes on runtime context Require dependency graphs, application architecture, and policy state to be available before any AI-generated change can be applied to source code.
- Tie remediation authority to policy Define which classes of findings can be auto-fixed, which require approval, and which must be suppressed because compensating controls already exist.
Bottom line: AI-assisted remediation is creating a new AppSec governance problem because teams must decide not only what is vulnerable, but which machine-generated fix is trustworthy in context.
Glossary terms: Identity Security Posture Management, Agentic remediation, Software Supply Chain Security, Attribute Fidelity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:40 pm
ASPM is becoming the control plane for machine-assisted remediation. The article points to a shift from isolated scanning toward orchestrated judgement across code, dependency, and runtime context. That matters because AI fixers do not fail only when they miss a flaw, but when they lack enough situational awareness to choose the right action. Practitioner implication: build remediation governance around correlated posture, not standalone scanner output.
A few things that frame the scale:
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: Should teams trust AI fixes before they trust code generation?
A: No. Code generation is only one part of the problem. Teams should first trust the governance layer that decides whether a fix is warranted, safe, and aligned to policy. Without that control layer, AI can produce more change, but not necessarily better security outcomes.
👉 Read our full editorial: Agentic code fixes need ASPM to keep software supply chains safe
This post was modified 1 day ago by NHI Mgmt Group