Topic starter
20/08/2026 6:10 pm
TL;DR: AI-accelerated development, automated attack execution, and supply chain abuse are converging into a capacity problem for AppSec teams, with the strongest signals coming from AI-generated code vulnerability rates, agent deployment gaps, and malware spreading through package ecosystems, according to Pixee. The practical takeaway is that review, testing, and runtime controls now have to scale with machine speed, not human pace.
Editorial analysis by NHI Mgmt Group, based on content published by Pixee: “Q4 2025 Retrospective: 10 Stats That Defined the Quarter in AppSec”.
By the numbers:
- Anthropic said Chinese state-sponsored threat actors used Claude to automate 90% of a cyberattack, according to Pixee.
- Nagomi Security’s 2025 CISO Pressure Index found that 44% of CISOs say burnout affects their ability to prepare for breaches, according to Pixee.
- EMA found that 98% of enterprises deploy AI agents while 79% of organisations without written policies deployed anyway, according to Pixee.
Key questions
Q: How should security teams manage AppSec when AI is writing code faster than humans can review it?
A: Teams should shift from discovery-centric reporting to remediation-centric governance.
Q: Why does using AI in repositories without code review increase application security risk?
A: AI generated code can accelerate delivery, but it also bypasses the human checkpoint that catches insecure logic, licensing issues, and malicious changes.
Q: What are the signs that AppSec controls are failing under AI code velocity?
A: Common signs include growing review backlogs, more vulnerabilities appearing in generated code, slower remediation than release cadence, and repeated fixes for the same classes of flaws.
Practitioner guidance
- Automate pre-merge security validation for high-volume AI code Shift repetitive AppSec checks into CI so generated code is scanned for insecure object references, XSS, password handling, and concurrency flaws before merge.
- Treat AI agent permissions as runtime controls Define what agents can access, what actions they can take, and when privilege expires, especially in delivery pipelines and other automated workflows.
- Restrict execution paths in package install workflows Block or tightly control install-time scripts, preinstall hooks, and other dependency execution paths that can propagate malicious code across environments.
Bottom line: AI-assisted development is widening the distance between how fast software is produced and how fast security teams can validate it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:46 pm
AI velocity has become an AppSec governance problem, not just an engineering productivity story. The central risk is that code creation now outpaces the control points designed around human review cycles. That creates a larger gap between what enters the pipeline and what security teams can inspect. Practitioners should treat throughput as a governance variable, not a developer preference.
A question worth separating out:
Q: How should teams govern package installation when dependency execution is part of the attack path?
A: Treat dependency installation as a privileged execution boundary. Disable or tightly restrict install-time scripts where possible, inspect build hooks, and assume upstream code can execute with broader rights than its source context suggests. The aim is to prevent trust inheritance from becoming propagation risk.
👉 Read our full editorial: AI velocity is widening AppSec’s vulnerability gap in Q4 2025