Topic starter
02/08/2026 9:41 am
TL;DR: A survey of 250+ AppSec stakeholders found 87% of organisations now use AI coding assistants, while 94% still rely on at least one testing tool and half spend 40% or more of their time triaging findings, according to StackHawk. The real problem is not tool scarcity but the gap between discovery, prioritisation, and business-risk measurement.
Editorial analysis by NHI Mgmt Group, based on content published by StackHawk: “The 2026 State of AI-Era AppSec: Key Findings from Our Survey”.
Key questions
Q: What breaks when AppSec relies on testing without full visibility?
A: Testing loses much of its value when teams do not know the full application and API footprint.
Q: Why do AI-assisted coding workflows increase the need for security review and test coverage?
A: AI can increase development speed, but speed also increases the chance that insecure logic, exposed secrets, or missing controls reach production.
Q: How can AppSec teams tell whether their metrics reflect real risk?
A: Look for metrics that connect findings to exposure, criticality, and trend over time.
Practitioner guidance
- Build continuous application discovery Replace quarterly spreadsheets and manual surveys with continuous discovery for applications, APIs, and runtime components so coverage is measured against what actually exists.
- Tie findings to business context Attach application criticality, data sensitivity, and exposure context to every finding so prioritisation reflects risk rather than raw defect volume.
- Reduce triage load with risk-based routing Use exploitability, exposure, and ownership metadata to route only high-value findings to analysts, and automate suppression for low-context noise.
Bottom line: AI-era AppSec now depends on knowing what exists before deciding what to test.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:35 pm
Visibility debt is becoming the defining AppSec governance problem. When AI-assisted development increases the number of applications, APIs, and code paths faster than manual discovery can track them, teams lose the ability to govern what they test. That is not a tooling shortage alone, but a control failure in inventory, ownership, and scope definition. Practitioners should treat continuous discovery as a prerequisite for any credible AppSec programme.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern non-human identities at scale?
A: Security teams should treat non-human identities as a lifecycle problem with ownership, review, rotation, and revocation built in from the start. Inventory is necessary but insufficient. The control objective is to ensure every service account, token, or automation identity has a clear purpose, a bounded scope, and a reliable offboarding path when it is no longer needed.
👉 Read our full editorial: AI-era AppSec is shifting from testing to visibility and risk