Notifications
Clear all
Topic starter
18/08/2026 3:01 pm
TL;DR: 451 Research and Daniel Kennedy’s analysis shows security leaders rank application security tool complexity as their top pain point, while AI is already producing 3 to 4 times more code and 10 times more security findings on average, pushing application security toward coordinated posture management according to Apiiro. The governance challenge is no longer just finding issues, but deciding which AI-generated fixes can be trusted in context.
NHIMG editorial — based on content published by Apiiro: The Rise of Agentic AI and the New Security Imperative
By the numbers:
- Developers using AI coding assistants generate 3 to 4 times more code and 10 times more security findings on average.
- 30% of enterprise code is already AI-generated and 75% of engineers are expected to use AI assistants by 2028.
- Only 33% of survey respondents said they were very confident in applying AI-generated code fixes to address identified vulnerabilities.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do fragmented AppSec tools make automated remediation less trustworthy?
A: Fragmentation forces agents to make decisions from partial evidence.
Q: What breaks when agentic remediation systems do not have enough context?
A: They can produce technically valid code that is operationally unsafe.
Practitioner guidance
- Define remediation approval boundaries Separate code changes that can be auto-applied from those that require human review, with explicit rules for secrets, API changes, and dependency updates.
- Correlate AppSec findings before automation Use a posture layer to deduplicate SAST, DAST, and SCA output so remediation agents receive a single governed view of risk instead of conflicting alerts.
- Scope agent access as privileged workflow access Treat repository and pipeline integrations used by remediation agents as privileged access paths, with least privilege, session logging, and revocation procedures.
What's in the full article
Apiiro's full article covers the operational detail this post intentionally leaves for the source:
- How AutoFix, AutoGovern, and AutoManage map findings into different remediation and policy workflows
- How the Deep Code Analysis layer models architecture and runtime dependencies before changes are applied
- How the MCP connection is used to connect remediation workflows to source code context
- How the article ties SLA, MTTR, and policy adherence into the remediation lifecycle
👉 Read Apiiro's analysis of agentic code fixes and ASPM in AppSec →
Agentic code fixes and ASPM: is your AppSec stack ready?
Explore further
18/08/2026 3:40 pm
ASPM is becoming the control plane for AI-assisted remediation, not just another AppSec dashboard. The article’s core insight is that code-fixing agents need correlated context before they can make defensible decisions. That is a governance shift, not a tooling tweak, because the security question moves from detection to authorisation of action. Practitioners should treat ASPM as the layer that determines whether remediation automation is allowed to act at all.
A question worth separating out:
Q: How do teams know whether AI-assisted remediation is actually helping?
A: Look for lower triage time, fewer false-positive escalations, and faster closure of the findings that matter most. If AI assistance only increases throughput but does not reduce exposure on regulated or privileged code paths, it is a productivity feature rather than a governance improvement. Measure outcomes, not just activity.
👉 Read our full editorial: Agentic code fixes need ASPM to keep software supply chains safe
