Topic starter
02/08/2026 9:41 am
TL;DR: AI coding assistants are now widely adopted, with 87% of organisations using tools such as GitHub Copilot, Cursor, or Claude Code to some extent and 53% of AppSec stakeholders seeing them as a moderate or significant risk, according to StackHawk. The real problem is not just code quality, but loss of developer context, overloaded review processes, and expanding attack surfaces that existing tooling cannot track at AI speed.
Editorial analysis by NHI Mgmt Group, based on content published by StackHawk: “The Real Reason AppSec Can’t Keep Up With AI Development (It’s Not What You Think)”.
By the numbers:
- 87% of organisations have adopted tools like GitHub Copilot, Cursor, or Claude Code to some extent, according to StackHawk.
- 53% of respondents view AI coding assistants as a moderate or significant security risk, according to StackHawk.
- Half of AppSec teams spend more than 40% of their time triaging and prioritizing findings, according to StackHawk.
Key questions
A: Treat speed as a control problem, not only a productivity gain.
Q: Why does AI-assisted code create more AppSec risk even when the code looks clean?
A: Because the risk is in the review model, not just the syntax.
Q: What breaks when security reviews cannot keep up with AI-accelerated development?
A: The control model breaks first, then the queue.
Practitioner guidance
- Establish security context checkpoints Capture why a feature exists, what it touches, and what authorization or data-flow changes it introduces at the point of code change, not later in review.
- Replace volume-based triage with risk-based prioritization Rank findings by business impact and exposure path so the AppSec team is not consuming most of its time on backlog management and low-value alerts.
- Add runtime validation for AI-augmented features Test how the application behaves with real prompts, retrieval paths, and authorization boundaries because static scans will not surface every AI-specific failure mode.
Bottom line: AI-assisted development is weakening AppSec governance by reducing the context developers retain about the code they ship.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:35 pm
AI-assisted development creates a context governance problem, not just a code quality problem. The central failure is that software teams lose the shared reasoning that normally explains why a feature exists, what data it touches, and which authorization decisions it depends on. That makes security reviews weaker even when the generated code is technically correct. Practitioners should treat developer context as a governed asset, not an informal by-product of coding.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations secure AI and LLM features inside applications?
A: Use runtime testing, data-boundary checks, and threat modelling that explicitly covers prompt injection, context poisoning, and guardrail bypass. These features create behaviours that static code analysis alone cannot see, so the control set has to move from code correctness to application behaviour and data handling at execution time.
👉 Read our full editorial: AI-assisted development is breaking AppSec velocity and context