Notifications
Clear all
Topic starter
02/08/2026 12:11 pm
TL;DR: 50% of organisations now use AI to write code, according to Checkmarx, while agentic security is being pushed into the IDE and build process to block unsafe completions and align policy earlier in development. Continuous governance is becoming necessary because AI-assisted code creation outpaces reactive AppSec models.
NHIMG editorial — based on content published by Checkmarx: AI agents in the SDLC and the future of application security
By the numbers:
- 50% of organizations now use AI to write code.
Questions worth separating out
Q: How should security teams govern AI agents that run long, multi-step workflows?
A: Security teams should require durable execution, full event history, and clear ownership for every multi-step agent workflow that touches sensitive data or privileged tools.
Q: Why does AI-assisted development complicate application security governance?
A: AI-assisted development complicates governance because the organisation must track who authorised the change, what system generated it, and whether the output can be audited.
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Practitioner guidance
- Map agent access to specific SDLC permissions Inventory what the AI agent can read, write, approve, and trigger across the IDE, SCM, and build pipeline.
- Enforce inline validation before code leaves the IDE Place security checks where code is created, not only where it is committed.
- Separate policy enforcement from telemetry reporting Do not confuse dashboards with control.
What's in the full article
Checkmarx's full analysis covers the operational detail this post intentionally leaves for the source:
- How Developer Assist validates AI-generated and human-written code inline in the IDE
- How Triage and Remediation Assist is positioned to apply governance in the build process and SCM
- How Insights Assist correlates developer behavior, policy enforcement, and telemetry into business metrics
- How Checkmarx frames agentic AI coverage across the wider SDLC rather than only code scanning
👉 Read Checkmarx's analysis of agentic AI teammates in application security →
AI agents in the SDLC: what IAM and AppSec teams should review?
Explore further
02/08/2026 1:14 pm
AI agents in development are becoming non-human identities, not just productivity features. Once an agent can reason, select actions, and interact with repositories or build systems, it needs governance equivalent to other machine actors. That means identity, privilege, and auditability become design requirements inside the SDLC, not post-hoc controls. Teams that ignore this will struggle to explain who changed what, when, and under which policy boundary.
A question worth separating out:
Q: How can organisations measure whether AppSec controls are working?
A: They should look for fewer repeat vulnerabilities, lower false-positive burden, faster developer adoption, and measurable reduction in high-risk bug classes. A healthy AppSec programme changes the shape of risk, not just the number of alerts. If findings remain high but exposure does not fall, the control model is not scaling.
👉 Read our full editorial: AI agents in the SDLC raise new appsec governance demands
