Topic starter
18/08/2026 2:18 pm
TL;DR: Claude Code Security can find and triage vulnerabilities at scale, including issues missed by rule-based SAST, but Boost Security argues that this does not replace enterprise AppSec because software risk also lives in dependencies, pipelines, endpoints, and runtime controls. The real shift is toward combining AI with inventory, prioritisation, policy enforcement, and incident response across the full software factory.
Editorial analysis by NHI Mgmt Group, based on content published by Boost Security: “The Death of AppSec Is Greatly Exaggerated”.
Key questions
A: Code review breaks down as a gate because it is too slow for the volume and speed of AI generated output.
Q: Why do coding agents increase the need for software security governance?
A: Coding agents can speed up secure coding, but they also increase the number of identities and automations that can change code, trigger builds, or deploy artifacts.
Q: What are the signs that AppSec is too dependent on first-party code scanning?
A: Common signs include repeated surprises from dependency updates, weak visibility into CI/CD changes, poor coverage of developer endpoints, and security teams that cannot answer what is internet-facing or PII-touching.
Practitioner guidance
- Inventory the full software factory Map repositories, CI jobs, build identities, developer endpoints, package sources, container images, and deployed services so security decisions reflect the real attack surface.
- Separate AI findings from enforcement decisions Use coding agents to accelerate discovery and remediation, but require deterministic policy gates for merge, build, and release decisions.
- Review pipeline and agent privileges Audit service accounts, token scopes, and workflow permissions so coding agents and CI systems cannot modify more than their task requires.
Bottom line: AI-assisted code review improves defect discovery, but it does not govern the broader software factory where dependencies, pipelines, endpoints, and runtime systems also create risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:10 pm
AI-assisted AppSec expands detection, but it does not collapse software risk into code review. The central governance error in the current debate is treating defect discovery as equivalent to software security. Code review, even when powered by LLMs, does not govern transitive dependencies, build systems, developer endpoints, or runtime boundaries. The right conclusion is that AI becomes a stronger detector inside a broader control plane, not a substitute for that control plane.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should teams prioritise AI-assisted scanning or pipeline control first?
A: Pipeline control usually comes first when build systems, release workflows, or developer credentials can be abused, because those paths can turn any code issue into a supply chain incident. AI scanning still matters, but it is most effective after teams have bounded who and what can move code through the software factory.
👉 Read our full editorial: AppSec is evolving, not dying, in the age of coding agents