Notifications
Clear all
Topic starter
02/08/2026 11:29 am
TL;DR: AI-assisted development is accelerating code volume while keeping vulnerability rates high, with nearly 45% of AI-generated code containing known security flaws when no guidance is provided and only 55% of code-generation tasks producing secure code, according to Veracode. The result is not just more code, but more security debt, faster attacker discovery, and a stronger need for continuous verification and risk-based governance.
NHIMG editorial — based on content published by Veracode: Why AI Changes Everything About Software Risk
By the numbers:
- Nearly 45% of AI-generated code contains known security vulnerabilities when no security guidance is provided.
- Only 55% of AI code generation tasks result in secure code.
- 82% of organizations carry security debt, up 11% in a single year.
Questions worth separating out
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why does AI make software supply chain risk harder to control?
A: AI increases the amount of code produced, which reduces the time available for review and makes malicious or unauthorized changes harder to spot.
Q: How can organisations tell whether AI-assisted development is actually working?
A: Use downstream indicators such as escaped defects, rework after merge, security findings, and time spent validating generated code.
Practitioner guidance
- Move security controls into the development workflow Run SAST at commit time, pair it with SCA for every build, and add DAST into CI/CD so AI-generated defects are caught before they reach release gates.
- Govern AI-influenced dependencies as a supply chain risk Require provenance checks for packages, block unapproved dependency introduction, and flag hallucinated package names before they can be pulled into the build.
- Prioritise exploitable findings over raw volume Use reachability, exposure, and business impact to rank remediation so teams do not spend scarce capacity clearing low-risk noise while exploitable issues remain open.
What's in the full article
Veracode's full post covers the operational detail this post intentionally leaves for the source:
- Detailed explanation of how AI-assisted development changes vulnerability introduction across the SDLC
- Veracode's remediation guidance on integrating SAST, SCA, and DAST into delivery pipelines
- Specific examples of how AI accelerates dependency introduction and supply chain exposure
- The compliance and governance framing behind software trust, attestations, and audit readiness
👉 Read Veracode's analysis of how AI is reshaping software risk →
AI code generation and software risk: what are security teams missing?
Explore further
02/08/2026 12:45 pm
AI code generation creates a governance gap, not just a quality problem. The central failure is the assumption that faster code production can be governed with the same review model built for human-paced delivery. That assumption no longer holds when generation, dependency introduction, and deployment all move faster than security validation. For identity and access teams, this also means treating pipeline actors, build services, and AI tools as governed entities with bounded privilege.
A question worth separating out:
Q: Should organisations automate remediation for AI-related cloud findings?
A: Organisations should automate triage and workflow routing before they automate remediation. AI-guided investigation can compress decision time, but final containment still needs accountable owners and verification. Automation works best when it speeds the path to a human decision rather than hiding the evidence behind the decision.
👉 Read our full editorial: AI is reshaping software risk faster than security teams can adapt
