Notifications
Clear all
Topic starter
19/08/2026 3:33 pm
TL;DR: Developers using AI coding assistants produced 3 to 4 times more code but introduced 10 times more vulnerabilities in Fortune 50 repositories, according to Apiiro, showing how AI-assisted velocity can outstrip AppSec workflows. The core issue is governance, not generation speed: enterprises need context-aware remediation at the point of code creation.
NHIMG editorial — based on content published by Apiiro: AI coding assistants and enterprise AppSec governance
By the numbers:
- Developers using AI coding assistants produced 3 to 4 times more code than their peers in Fortune 50 enterprise repositories.
- Those same developers introduced 10 times the number of vulnerabilities as their peers.
Questions worth separating out
Q: How should security teams govern AI coding assistants that can execute commands?
A: Treat them as delegated non-human identities with bounded execution authority.
Q: Why do AI coding assistants increase AppSec governance risk?
A: They increase risk because they optimise for speed and plausible output, not for context-aware security validation.
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Practitioner guidance
- Enforce policy checks before code reaches review Insert policy evaluation into the assistant-assisted workflow so insecure patterns are blocked before pull requests are opened.
- Tie remediation guidance to runtime and ownership context Require fixes to account for code-to-runtime impact, service ownership, and architectural constraints so recommendations are actionable in the enterprise, not just syntactically correct.
- Measure AI-assisted throughput against AppSec capacity Compare generated change volume, vulnerability findings, and triage backlog to determine whether your review model can absorb assistant-driven output without creating unmanaged security debt.
What's in the full article
Apiiro's full analysis covers the operational detail this post intentionally leaves for the source:
- How Gemini responses are enriched with enterprise-specific policy, runtime, and ownership context
- How the AutoFix Agent shapes remediation recommendations so they fit local architecture and governance rules
- How code-to-runtime intelligence and the Risk Graph are used to prioritise issues into risk groups
- How organisations can connect AI coding tools to secure software delivery without adding extra review friction
👉 Read Apiiro's analysis of AI coding assistants and enterprise vulnerability debt →
AI coding assistants and vulnerability debt: can controls keep up?
Explore further
19/08/2026 4:15 pm
AI-assisted coding has become a governance problem before it is a productivity problem. When assistants can multiply code output several times, the security function inherits a larger stream of decisions, not just a larger codebase. That shifts the burden from catching defects at review time to constraining unsafe suggestions at generation time. For practitioners, the question is whether policy can be enforced close enough to the developer workflow to matter.
A question worth separating out:
Q: When does AI-assisted development create more risk than it reduces?
A: It becomes net risk when code volume grows faster than ownership, review, and fix capacity. That is especially true when secrets, dependencies, and business logic are handled in separate tools. If teams cannot prioritise by reachability and impact, speed turns into hidden debt.
👉 Read our full editorial: AI coding assistants raise code volume and vulnerability debt
