Notifications
Clear all
Topic starter
02/08/2026 11:25 am
TL;DR: AI-generated code carries the same vulnerability classes as human-written code, while security teams still need automated scanning, policy gates, and rapid remediation to keep pace with code velocity, according to Veracode. The real control problem is not restricting one model, but building an AppSec control plane that measures risk fixed and shipped.
NHIMG editorial — based on content published by Veracode: Why Restricting AI Code Security Tools Is the Wrong Answer and What AppSec Programs Actually Need
Questions worth separating out
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why do development pipelines create identity governance risk?
A: Pipelines often create, store, and use service accounts, tokens, certificates, and API keys outside normal identity lifecycle controls.
Q: What do security teams get wrong about AI access risk?
A: Many teams focus on the model while ignoring the identity path that reaches it.
Practitioner guidance
- Move AppSec enforcement into the pipeline Insert automated checks before merge so generated and human-written code face the same controls for vulnerability detection, dependency risk, secrets scanning, and infrastructure misconfiguration.
- Extend NHI controls into build and deployment workflows Inventory API keys, tokens, certificates, and service credentials that appear in repositories, CI jobs, and deployment manifests.
- Separate model assistance from security enforcement Use advanced AI models selectively for complex analysis, but keep scanning, policy gates, and evidence production independent of any single model’s willingness to handle security queries.
What's in the full article
Veracode's full analysis covers the operational detail this post intentionally leaves for the source:
- How the control plane maps across SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST, and fuzzing.
- How Veracode Fix generates developer-ready remediation and what evidence teams need to support merge decisions.
- How the AI-assisted workflow changes the cost and timing trade-offs between selective model use and automated scanning.
- How policy gates and remediation loops are meant to work together in the vendor's operational model.
👉 Read Veracode's analysis of why AI code security needs an automated control plane →
AI code security controls: are AppSec teams keeping up with AI speed?
Explore further
02/08/2026 12:41 pm
AppSec has become a control-plane problem, not a tooling problem. When code can be generated continuously, security has to sit inline with delivery and make enforcement decisions before merge. That changes the design centre of AppSec from review to governance. For identity programmes, the same logic applies to secrets, service accounts, and deployment credentials that enter pipelines through code. Practitioners should treat pipeline controls as part of identity governance, not as a separate DevSecOps concern.
A question worth separating out:
Q: How do teams know whether AI-assisted AppSec is actually helping?
A: Look for findings that can be traced back to named components, repeated across assessments, and mapped to concrete remediation actions. If the system produces faster output but reviewers still cannot understand why a requirement exists, the programme has improved throughput without improving governance.
👉 Read our full editorial: AI code security needs an automated control plane, not model limits
