Notifications
Clear all
Topic starter
19/08/2026 3:29 pm
TL;DR: Google sees only about a 10% increase in velocity even though roughly 30% of code now gets AI assistance, while Kusari says its own workflow changes cut vulnerability remediation from 110 days to 1 day and lifted velocity 8x. The bottleneck is no longer code generation but the security and review work that still gates delivery.
NHIMG editorial — based on content published by Kusari: why AI coding speeds up output but not delivery without security checks
By the numbers:
- Google sees only about a 10% increase in velocity despite roughly 30% of code getting an assist from AI in some form.
- Kusari says it dropped mean time to remediation for vulnerabilities from 110 days to 1 day in one month.
Questions worth separating out
Q: How should security teams reduce rework when AI accelerates code changes?
A: They should move security checks closer to authoring time, because the cost of fixing issues rises sharply after merge.
Q: Why do AI coding tools often fail to produce proportional delivery gains?
A: Because code generation is only one step in delivery.
Q: What do teams get wrong about measuring AI coding productivity?
A: They often measure lines of code or developer output instead of end-to-end delivery time.
Practitioner guidance
- Implement pull-request security gates for high-risk changes Scan every merge request for vulnerabilities, unmaintained libraries, and embedded credentials before code can advance to review or release.
- Measure delivery friction beyond developer output Track time spent in security review, re-review, retesting, and remediation alongside code generation metrics.
- Tighten secret scanning around AI-assisted code paths Prioritise repositories, prompts, and build outputs where AI is used most heavily, because those paths are more likely to spread credential material or insecure access patterns quickly.
What's in the full article
Kusari's full analysis covers the operational detail this post intentionally leaves for the source:
- The specific workflow changes Kusari used to cut remediation time from 110 days to 1 day
- How Kusari Inspector evaluates pull requests for vulnerabilities and unmaintained libraries
- The case study details behind the reported 8x velocity increase
- The webinar context and deployment discussion behind the delivery workflow
👉 Read Kusari's analysis of why AI coding does not automatically speed delivery →
AI coding speed without delivery gains: where is the bottleneck?
Explore further
19/08/2026 4:13 pm
AI coding creates a throughput illusion when security review remains serial. The article shows that faster code generation does not equal faster delivery when the review, remediation, and approval layers stay unchanged. That is a process design problem, not a developer productivity problem. For identity-heavy environments, the same logic applies to secrets, privileges, and release approvals. Practitioners should treat AI-assisted development as a queue-management issue, not just an engineering efficiency story.
A question worth separating out:
Q: How should organisations handle identity and secrets risk in AI-assisted pipelines?
A: Treat AI-generated code as a higher-volume source of identity and secrets exposure. That means continuous secret scanning, tighter approval for code touching access logic, and faster remediation of risky dependencies. The goal is to keep credentials, service identities, and access assumptions from scaling faster than the controls around them.
👉 Read our full editorial: AI coding speeds up output but not delivery without security checks
