Topic starter
18/08/2026 3:01 pm
TL;DR: 451 Research and Daniel Kennedy’s analysis shows security leaders rank application security tool complexity as their top pain point, while AI is already producing 3 to 4 times more code and 10 times more security findings on average, pushing application security toward coordinated posture management according to Apiiro. The governance challenge is no longer just finding issues, but deciding which AI-generated fixes can be trusted in context.
Editorial analysis by NHI Mgmt Group, based on content published by Apiiro: “Confidence in Agentic Code Fixes is rising – but not without a strong ASPM program”.
By the numbers:
- Developers using AI coding assistants generate 3-4× more code and 10× more security findings on average.
- 30% of enterprise code is already AI-generated.
- 75% of engineers are expected to use AI assistants by 2028.
Key questions
Q: Where does agentic remediation fail when AppSec tools are not coordinated?
A: It fails when individual scanners produce findings without a shared model of code structure, dependencies, and compensating controls.
Q: Why do AI-generated code fixes need policy and runtime context?
A: Because a fix is only safe if the system knows how the application behaves, what controls already exist, and which exceptions are formally approved.
Q: What are the signs that automated code remediation is becoming unsafe?
A: Common signals include duplicated findings across tools, repeated suppression of the same issue, fixes that fail in pre-production, and changes that violate architecture or policy intent.
Practitioner guidance
- Correlate AppSec findings before remediation Unify SAST, SCA, secrets, DAST, and code review outputs into one risk view so automated fixes do not act on duplicate or incomplete alerts.
- Gate agentic fixes on runtime context Require dependency graphs, application architecture, and policy state to be available before any AI-generated change can be applied to source code.
- Tie remediation authority to policy Define which classes of findings can be auto-fixed, which require approval, and which must be suppressed because compensating controls already exist.
Bottom line: AI-assisted remediation is creating a new AppSec governance problem because teams must decide not only what is vulnerable, but which machine-generated fix is trustworthy in context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:40 pm
ASPM is becoming the control plane for machine-assisted remediation. The article points to a shift from isolated scanning toward orchestrated judgement across code, dependency, and runtime context. That matters because AI fixers do not fail only when they miss a flaw, but when they lack enough situational awareness to choose the right action. Practitioner implication: build remediation governance around correlated posture, not standalone scanner output.
A few things that frame the scale:
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: Should teams trust AI fixes before they trust code generation?
A: No. Code generation is only one part of the problem. Teams should first trust the governance layer that decides whether a fix is warranted, safe, and aligned to policy. Without that control layer, AI can produce more change, but not necessarily better security outcomes.
👉 Read our full editorial: Agentic code fixes need ASPM to keep software supply chains safe