AI-generated code and AppSec audits: where governance breaks down

TL;DR: AI-assisted development is now mainstream, with GitHub reporting that 92% of developers use AI coding tools and many organisations generating 40% or more of new code with AI, according to LEGIT Security. Traditional AppSec controls were built for post-commit review, but AI code generation at the developer endpoint creates traceability, enforcement, and audit gaps that require pre-commit governance.

NHIMG editorial — based on content published by LEGIT Security: Executive Brief on the audit questions AI is creating for security

By the numbers:

• 92% of developers now use AI coding tools, according to GitHub.
• AI-generated code contributes to 40% or more of new code in many organisations, according to LEGIT Security.
• 68% of developers use unapproved AI tools for work tasks, according to a recent survey cited by LEGIT Security.

Questions worth separating out

Q: What breaks when AI-generated code is only checked after commit?

A: Post-commit controls miss the moment when risky code is created, so secrets, insecure patterns, and policy violations can enter the repository before security ever sees them.

Q: Why do AI coding agents create different governance risks from normal developer tools?

A: AI coding agents combine code execution, context persistence, external tool access, and memory across sessions.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.

Practitioner guidance

• Implement pre-commit AI governance at the developer endpoint Enforce policy checks where AI code is generated, not only in repositories or CI, so risky output can be blocked before commit.
• Create an auditable inventory of AI coding tools Maintain an approved-tool register and detect unauthorised assistants used in IDEs, browsers, and local workflows so shadow AI does not bypass governance.
• Capture generation-time evidence for every AI-assisted change Log prompt context, policy evaluation, user action, and generated output together so internal audit and external assurance can reconstruct the decision path.

What's in the full article

LEGIT Security's full brief covers the operational detail this post intentionally leaves for the source:

• Representative audit question sets for AI-generated code, including visibility, policy enforcement, and traceability checks
• The pre-commit governance workflow and the evidence elements captured at the developer endpoint
• Practical examples of how leading teams measure AI-generated code compliance over time
• The vendor's technical architecture guide for integrating endpoint governance into SDLC workflows

👉 Read LEGIT Security's brief on AI-generated code audit questions and governance gaps →

AI-generated code and AppSec audits: where governance breaks down?

Explore further

View Full Forum →  |  NHI Foundation Course →