Topic starter
02/08/2026 9:41 am
TL;DR: AI coding assistants now sit inside most development workflows, with StackHawk reporting that 87% of organisations use them while 94% still rely on at least one testing tool. AppSec needs visibility into the full application and API footprint before scan results can show what really matters.
Editorial analysis by NHI Mgmt Group, based on content published by StackHawk: “The 2026 State of AI-Era AppSec: Key Findings from Our Survey”.
Key questions
Q: Why do AI-assisted coding workflows increase the need for security review and test coverage?
A: AI can increase development speed, but speed also increases the chance that insecure logic, exposed secrets, or missing controls reach production.
Q: How can AppSec teams tell whether their metrics reflect real risk?
A: Look for metrics that connect findings to exposure, criticality, and trend over time.
Q: What breaks when AppSec relies on testing without full visibility?
A: Testing loses much of its value when teams do not know the full application and API footprint.
Practitioner guidance
- Build continuous application discovery Replace quarterly spreadsheets and manual surveys with continuous discovery for applications, APIs, and runtime components so coverage is measured against what actually exists.
- Tie findings to business context Attach application criticality, data sensitivity, and exposure context to every finding so prioritisation reflects risk rather than raw defect volume.
- Reduce triage load with risk-based routing Use exploitability, exposure, and ownership metadata to route only high-value findings to analysts, and automate suppression for low-context noise.
Bottom line: AI-era AppSec now depends on knowing what exists before deciding what to test.
Glossary terms: Activity Visibility, Triage debt, Risk Reduction Metric, Machine Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:35 pm
Visibility debt is becoming the defining AppSec governance problem. When AI-assisted development increases the number of applications, APIs, and code paths faster than manual discovery can track them, teams lose the ability to govern what they test. That is not a tooling shortage alone, but a control failure in inventory, ownership, and scope definition. Practitioners should treat continuous discovery as a prerequisite for any credible AppSec programme.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern non-human identities at scale?
A: Security teams should treat non-human identities as a lifecycle problem with ownership, review, rotation, and revocation built in from the start. Inventory is necessary but insufficient. The control objective is to ensure every service account, token, or automation identity has a clear purpose, a bounded scope, and a reliable offboarding path when it is no longer needed.
👉 Read our full editorial: AI-era AppSec is shifting from testing to visibility and risk