Topic starter
02/08/2026 12:11 pm
TL;DR: 50% of organisations now use AI to write code, according to Checkmarx, while agentic security is being pushed into the IDE and build process to block unsafe completions and align policy earlier in development. Continuous governance is becoming necessary because AI-assisted code creation outpaces reactive AppSec models.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Your New Teammate Doesn’t Eat Pizza”.
By the numbers:
- 50% of organisations now use AI to write code.
Key questions
Q: How should security teams govern AI agents and LLM tools in the SDLC?
A: Treat AI agents and LLM integrations as privileged workloads with explicit identity, task scope, and approval boundaries.
Q: Why do AI agents make reactive AppSec less effective?
A: Reactive AppSec assumes there is time to find and fix issues after code exists, but AI agents can generate, validate and propagate code faster than review cycles can respond.
Q: What are the main failure modes when AI-generated code enters the SDLC?
A: The main failure modes are unsafe completions, policy mismatch and over-reliance on downstream scanning.
Practitioner guidance
- Define agent authority in the SDLC Specify exactly what AI agents may read, suggest, block and approve inside the IDE, build process and source control before deployment.
- Move enforcement into code creation Add inline policy checks that evaluate AI-generated and human-written code while it is being authored, not only after commit.
- Align security policy across tools Use one policy model for IDE controls, build-time validation and SCM enforcement so the same rule is applied consistently.
Bottom line: AI agents are changing application security by moving governance into the IDE and build process, where code is created rather than only reviewed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:14 pm
Agentic AI is becoming a governance layer, not just a productivity layer. Once reasoning systems sit inside the IDE and build process, they influence which code exists, which policy checks fire and which fixes are proposed. That means security teams are no longer governing only people and pipelines, but software actors that participate in development decisions. Practitioners should treat agent permissions, policy scope and auditability as first-class governance concerns.
A question worth separating out:
Q: How do AppSec and IAM teams evaluate whether agentic governance is working?
A: Look for whether agent actions are bounded, logged and reviewed consistently across development stages. If the organisation can show what the agent was allowed to do, what it actually did and where policy stopped unsafe output, governance is maturing. If those questions cannot be answered, the agent is operating with unclear authority.
👉 Read our full editorial: AI agents in the SDLC raise new appsec governance demands