Topic starter
19/08/2026 3:31 pm
TL;DR: AI coding assistants are driving 3 to 4 times more commits and more than 10 times as many OSS and SAST findings in Fortune 20 environments, according to Apiiro's analysis, while traditional review and scanning workflows struggle to absorb the volume. The governance problem is no longer code generation alone, but how to enforce runtime-aware, policy-based decisions before risky changes reach production.
Editorial analysis by NHI Mgmt Group, based on content published by Apiiro: “Webinar Recap: The Evolution of AppSec for the AI Era”.
By the numbers:
- Developers using AI assistants produced 3-4× more commits in Apiiro's Fortune 20 analysis.
Key questions
Q: What breaks when AI-assisted coding outpaces AppSec review cycles?
A: Manual triage and blanket scanning lose effectiveness when code volume rises faster than security capacity.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: How can AppSec teams tell whether their controls are keeping pace with AI delivery?
A: Look for signals such as shrinking triage backlog, faster validation cycles, and a complete inventory of AI-enabled features, endpoints, and data flows.
Practitioner guidance
- Embed policy checks in the IDE Move security guidance to the point of change so risky code is flagged before it enters pull request queues and review backlogs.
- Prioritise findings by runtime context Rank issues using exposure, compensating controls, ownership, and blast radius so teams spend time on exploitability rather than raw scanner volume.
- Measure developer trust in autofix Track acceptance rates for suggested fixes in the IDE and pull request flow to see whether automated guidance is accurate enough to use.
Bottom line: AI-assisted development is increasing code throughput faster than traditional AppSec gates can review it, which turns security into a scale and prioritisation problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:13 pm
AI-assisted development has turned AppSec into a scale problem before it is a code-quality problem. The article's strongest signal is not that AI creates new categories of bugs, but that it multiplies change faster than existing review and scanning models can absorb. When output volume rises 3 to 4 times and findings spike more than 10 times, the governance issue becomes throughput control, not just vulnerability management.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should security leaders rely on scanners or runtime-aware guardrails first?
A: Runtime-aware guardrails should come first when AI is increasing the pace of change, because scanners alone cannot decide what matters in the live architecture. Scanning remains useful, but it works best after policy and runtime context have already narrowed the problem set.
👉 Read our full editorial: AI-assisted development is outpacing AppSec controls