Topic starter
14/09/2026 10:10 am
TL;DR: AI-driven development is compressing the time available for review, ownership, and release gating, while source control inventory and vulnerability triage are lagging behind, according to Apiiro’s panel discussion with leaders from GitHub, Apiiro, and Akamai. The practical shift is from blocking defects late to governing agent-driven change earlier, because velocity now outpaces traditional AppSec controls.
Editorial analysis by NHI Mgmt Group, based on content published by Apiiro: “OWASP Israel Panel: AI Velocity and the Breaking Point of Security Frameworks”.
Key questions
Q: What breaks when AI-assisted coding outpaces AppSec review cycles?
A: Manual triage and blanket scanning lose effectiveness when code volume rises faster than security capacity.
Q: Why do prompt-speed development workflows increase application risk?
A: Because the security model assumes there is enough time to review, triage, and block risky changes.
Q: What are the signs that AppSec governance is lagging behind AI development?
A: The clearest signs are unclear code ownership, delayed vulnerability routing, inconsistent framework approval, and release decisions that rely on manual review after the change is already too large to inspect well.
Practitioner guidance
- Implement earlier inventory controls Capture generated code, new dependencies, and framework introductions before merge so AppSec can see what the agent added while the change is still explainable.
- Automate ownership resolution Link code changes to explicit owners, escalation paths, and remediation queues so teams do not lose time determining who must act on a finding.
- Move policy checks into commit and merge stages Enforce code-owner attestations, approved-framework allowlists, and security policy validation before a change reaches production approval.
Bottom line: AI-driven development is weakening the assumption that AppSec can safely inspect change after it has been created, because velocity now outruns inventory and ownership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:11 am
AI-driven development has turned inventory into a security control, not an administrative task. When agents can expand codebases faster than humans can map them, inventory becomes the prerequisite for every other AppSec decision. Without it, ownership, review, and policy enforcement all degrade into guesswork. Practitioners should treat software inventory as a live governance layer, not a periodic hygiene exercise.
A question worth separating out:
Q: How should AppSec teams and platform teams share accountability for AI-assisted delivery?
A: They should share responsibility for the controls that make AI-assisted delivery governable: inventory, ownership, policy enforcement, and release evidence. AppSec should define the risk thresholds and control expectations, while platform and engineering teams embed those controls into the delivery path. That division keeps accountability close to the code while preserving governance oversight.
👉 Read our full editorial: AI-driven development is exposing AppSec governance gaps