Topic starter
20/08/2026 6:10 pm
TL;DR: AI-generated code risk, automated attack execution, and supply-chain abuse converged into a capacity problem for AppSec teams in Q4 2025, Pixee noted. AppSec workflows now need validation, execution boundaries, and runtime controls that can handle machine-speed abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Pixee: “Q4 2025 Retrospective: 10 Stats That Defined the Quarter in AppSec”.
By the numbers:
- Anthropic said Chinese state-sponsored threat actors used Claude to automate 90% of a cyberattack, according to Pixee.
- Nagomi Security’s 2025 CISO Pressure Index found that 44% of CISOs say burnout affects their ability to prepare for breaches, according to Pixee.
- EMA found that 98% of enterprises deploy AI agents while 79% of organisations without written policies deployed anyway, according to Pixee.
Key questions
Q: Why does using AI in repositories without code review increase application security risk?
A: AI generated code can accelerate delivery, but it also bypasses the human checkpoint that catches insecure logic, licensing issues, and malicious changes.
Q: What are the signs that AppSec controls are failing under AI code velocity?
A: Common signs include growing review backlogs, more vulnerabilities appearing in generated code, slower remediation than release cadence, and repeated fixes for the same classes of flaws.
Q: How should security teams manage AppSec when AI is writing code faster than humans can review it?
A: Teams should shift from discovery-centric reporting to remediation-centric governance.
Practitioner guidance
- Automate pre-merge security validation for high-volume AI code Shift repetitive AppSec checks into CI so generated code is scanned for insecure object references, XSS, password handling, and concurrency flaws before merge.
- Treat AI agent permissions as runtime controls Define what agents can access, what actions they can take, and when privilege expires, especially in delivery pipelines and other automated workflows.
- Restrict execution paths in package install workflows Block or tightly control install-time scripts, preinstall hooks, and other dependency execution paths that can propagate malicious code across environments.
Bottom line: AI-assisted development is widening the distance between how fast software is produced and how fast security teams can validate it.
Glossary terms: AI-Generated Code Risk, Capacity Gap, Install-Time Execution, Runtime Protection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
20/08/2026 6:46 pm
AI velocity has become an AppSec governance problem, not just an engineering productivity story. The central risk is that code creation now outpaces the control points designed around human review cycles. That creates a larger gap between what enters the pipeline and what security teams can inspect. Practitioners should treat throughput as a governance variable, not a developer preference.
A question worth separating out:
Q: How should teams govern package installation when dependency execution is part of the attack path?
A: Treat dependency installation as a privileged execution boundary. Disable or tightly restrict install-time scripts where possible, inspect build hooks, and assume upstream code can execute with broader rights than its source context suggests. The aim is to prevent trust inheritance from becoming propagation risk.
👉 Read our full editorial: AI-generated code is widening AppSec’s validation gap in Q4 2025
This post was modified 1 day ago by NHI Mgmt Group