AI-built applications: what happens when security cannot keep up?

TL;DR: AI-driven development is compressing release cycles while expanding attack surface, creating blind spots from Shadow AI, opaque code generation, hardcoded secrets and faster deployment than traditional AppSec reviews can handle, according to Pluto Security. Security teams need AI-aware testing, stronger governance and runtime monitoring or risk visibility will lag the software they are shipping.

Editorial analysis by NHI Mgmt Group, based on content published by Pluto Security: “AI Application Security: The Risk of Apps Built Faster Than Security Can See”.

By the numbers:

• Pluto Security is officially out of stealth with $42 million in total funding.

Key questions

Q: How should security teams govern AI-generated code in production environments?

A: Security teams should treat AI-generated code as normal production code with extra provenance risk.

Q: Why do AI-generated code changes increase application security risk?

A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.

Q: What are the first controls to add when developers start using AI coding tools?

A: Start with inventory and review.

Practitioner guidance

• Build an approved AI tool inventory Track every sanctioned and unsanctioned AI system used in development, including embedded AI features in SaaS products, so security can define data handling, retention and access boundaries.
• Add security gates to AI-generated code Require pre-merge checks for secrets, weak authorisation, unsafe API calls and dependency risk before generated code can move into mainline builds or production release paths.
• Shift AppSec review left into CI/CD Embed automated testing and runtime checks into build pipelines so the same workflow that accelerates delivery also catches insecure patterns before deployment.

Bottom line: AI-assisted development creates a control gap when software is produced faster than security can review, inventory and approve it.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →