Topic starter
25/10/2026 11:10 am
TL;DR: Shadow AI, opaque code generation and embedded secrets can leave security teams unable to inventory AI-built apps fast enough, according to Pluto Security. When delivery outpaces review, AppSec needs upstream checks or visibility will lag the software being shipped.
Editorial analysis by NHI Mgmt Group, based on content published by Pluto Security: “AI Application Security: The Risk of Apps Built Faster Than Security Can See”.
By the numbers:
- Pluto Security is officially out of stealth with $42 million in total funding.
Key questions
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What are the first controls to add when developers start using AI coding tools?
A: Start with inventory and review.
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Practitioner guidance
- Build an approved AI tool inventory Track every sanctioned and unsanctioned AI system used in development, including embedded AI features in SaaS products, so security can define data handling, retention and access boundaries.
- Add security gates to AI-generated code Require pre-merge checks for secrets, weak authorisation, unsafe API calls and dependency risk before generated code can move into mainline builds or production release paths.
- Shift AppSec review left into CI/CD Embed automated testing and runtime checks into build pipelines so the same workflow that accelerates delivery also catches insecure patterns before deployment.
Bottom line: AI-assisted development creates a control gap when software is produced faster than security can review, inventory and approve it.
Glossary terms: AI Application Security, Shadow AI, Generated Code Risk, DevSecOps Pipeline Protection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
AI application security is becoming a governance problem, not just a code quality problem. The article makes clear that the failure mode is organisational: teams are shipping software faster than they can inventory, assess and approve what AI has produced. That changes the control objective from after-the-fact review to governable generation, with AppSec, IAM and data handling all converging at the point of code creation. Practitioners should treat AI-assisted development as a managed risk domain, not a productivity side channel.
A question worth separating out:
Q: How do organisations stop shadow AI from creating access and data exposure risk?
A: Organisations need explicit usage policy, service discovery, and data access boundaries so employees know what is approved and what is not. Then they must monitor for unauthorised tools, unusual data flows, and unowned identities. Without that combination, shadow AI becomes invisible NHI sprawl with unclear accountability.
👉 Read our full editorial: AI-built applications outpace AppSec controls and expand exposure
This post was modified 7 days ago by NHI Mgmt Group