Notifications
Clear all
Topic starter
28/08/2026 12:04 pm
TL;DR: AI-driven software development is multiplying code velocity and attack surface faster than many AppSec and risk processes can keep up, according to Apiiro’s executive panel. The governance gap is not just more code, but weaker ownership, slower review, and harder prioritisation when AI agents, open source dependencies, and ephemeral assets converge.
NHIMG editorial — based on content published by Apiiro: an executive forum on AI-powered AppSec models in an AI-driven world
By the numbers:
- AI increases velocity by 4 times, but risk by 10 times in the panel discussion.
- AI is expanding the attack surface 10x, sometimes 100x, according to Armis CEO Yevgney Dibrov.
- 90% of the code used in projects is not owned by developers, according to Thomas Dohmke.
Questions worth separating out
Q: What breaks when AI agents can make code changes faster than humans can review them?
A: Manual review stops being a meaningful control if it cannot keep pace with change volume.
Q: Why does AI-assisted development complicate application security governance?
A: AI-assisted development complicates governance because the organisation must track who authorised the change, what system generated it, and whether the output can be audited.
Q: What do teams get wrong about securing AI coding assistants?
A: Teams often focus on code output and ignore the agent boundary, where file reads, tool outputs, and external content shape the next action.
Practitioner guidance
- Map AI-assisted development paths end to end Identify where code is generated, reviewed, tested, approved, and deployed, then flag every point where an AI system can influence the path without named human accountability.
- Bound AI agents with explicit technical authority Assign each AI development agent a clear scope for repository access, build actions, and deployment influence, then log every privileged action as if it were performed by a service account.
- Shift from review dependence to prevention controls Add policy gates, secure-by-default templates, dependency controls, and automated checks before merge so that human review becomes a backstop rather than the primary safeguard.
What's in the full article
Apiiro's full executive forum covers the operational detail this post intentionally leaves for the source:
- Panel-level discussion of how banking and enterprise risk frameworks break when AI accelerates code generation and review pressure rises
- Direct commentary from senior security leaders on accountable ownership for AI adoption across development and risk teams
- Specific guidance on how organizations can think about AI agents that write, review, and secure code in parallel
- Context from the executive forum on board-level reporting and the velocity-versus-risk tradeoff in AI coding adoption
👉 Read Apiiro’s executive panel on AI-driven development risk and AppSec governance →
AI code velocity is forcing AppSec teams to rethink governance?
Explore further
28/08/2026 12:04 pm
AI-assisted development has created governance debt, not just productivity gain. Faster code generation matters, but the real security issue is that review, ownership, and prioritisation models were built for slower human-paced delivery. Once AI compresses the development cycle, the organisation inherits a backlog of unreviewed risk that traditional AppSec cadence cannot absorb. The practitioner conclusion is to treat AI velocity as a governance stress test, not a success metric.
A question worth separating out:
Q: How should organisations govern AI agents that can modify repository code?
A: They should treat the agent as a delegated non-human identity with tightly bounded authority. Separate instruction input from execution rights, require human approval for write actions, and log every agent-initiated change with enough context to support review. If the agent can edit code without that separation, prompt injection becomes a privilege escalation path.
👉 Read our full editorial: AI-driven development is outpacing AppSec risk frameworks
