Notifications
Clear all
Topic starter
20/08/2026 6:10 pm
TL;DR: AI-accelerated development, automated attack execution, and supply chain abuse are converging into a capacity problem for AppSec teams, with the strongest signals coming from AI-generated code vulnerability rates, agent deployment gaps, and malware spreading through package ecosystems, according to Pixee. The practical takeaway is that review, testing, and runtime controls now have to scale with machine speed, not human pace.
NHIMG editorial — based on content published by Pixee: Q4 2025 Retrospective: 10 Stats That Defined the Quarter in AppSec
By the numbers:
- Anthropic reported that nation-state actors automated 90% of a cyberattack using Claude AI, including reconnaissance and lateral movement.
- EMA found that 98% of enterprises deploy AI agents, while 79% of organisations without written policies deployed them anyway.
- CrowdStrike’s survey found that 76% of organisations are struggling to keep pace with the volume of code AI tools generate.
Questions worth separating out
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why do AI agents create new risk in non-human identity management?
A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.
Q: How do you know if AI agent remediation is actually working?
A: The original attack chain must fail after the fix, and close variants should fail too.
Practitioner guidance
- Set security gates to match AI code throughput Use automated SAST, secret scanning, policy checks, and test enforcement on every AI-generated change set so review capacity is not the bottleneck.
- Inventory AI agents as governed identities Assign explicit owners, permissions, expiry conditions, and offboarding paths to every agent that can call tools, read data, or trigger workflows.
- Reduce standing privilege in tool-connected pipelines Limit the scope of service accounts, API keys, and connector tokens used by build systems and AI workflows so compromise cannot spread laterally.
What's in the full article
Pixee's full retrospective covers the operational detail this post intentionally leaves for the source:
- Week-by-week AppSec briefing context that shows how the Q4 signals evolved across the quarter
- The underlying source articles and the full evidence trail behind each of the 10 stats
- Per-stat interpretations on why the trends matter for developers, AppSec, and AI governance teams
- The weekly remediation and tooling themes that explain where security capacity is breaking down
👉 Read Pixee’s Q4 2025 AppSec retrospective on AI velocity, agent risk, and security capacity →
AI code velocity vs AppSec capacity: what should teams change now?
Explore further
20/08/2026 6:46 pm
AI velocity is now an access-control problem, not just a code-quality problem. When code generation accelerates faster than review and validation capacity, the governing question shifts from defect detection to blast-radius control. That is why frameworks such as NIST AI Risk Management Framework and OWASP Agentic AI Top 10 matter alongside AppSec tooling. The practitioners who will cope best are the ones who treat throughput as a security design variable, not a productivity KPI.
A question worth separating out:
Q: Who should be accountable when an AI agent causes a security incident?
A: Accountability should sit with the human owner, platform team, or business function that granted and operated the agent. The identity may act independently, but governance cannot detach responsibility from the delegation chain. Programs should define ownership, escalation, and remediation paths before deployment so responsibility is clear when the agent's behaviour changes.
👉 Read our full editorial: AI velocity is widening AppSec’s vulnerability gap in Q4 2025
