Topic starter
02/08/2026 11:36 am
TL;DR: AI-generated code can carry two to three times the vulnerability density of human-written code, while 81% of organisations still knowingly ship software with identified vulnerabilities, according to Checkmarx research. The security gap is no longer just volume. It is the loss of context, the acceleration of exploitation, and the need for automated controls that operate at code-creation speed.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Something’s Wrong With Your Code. And Attackers Know It.”.
By the numbers:
- 81% of organisations knowingly ship software with vulnerabilities they have already identified.
Key questions
Q: How should teams secure AI-generated applications before they reach production?
A: Treat security as a precondition of generation, not a review step at the end.
Q: Why do AI-assisted commits increase software supply chain risk?
A: AI-assisted development increases the number and speed of changes, which reduces the time available for human verification.
Q: What breaks when security review happens after code context is gone?
A: Review becomes slower, less accurate, and harder to remediate because developers no longer remember the trade-offs behind the change.
Practitioner guidance
- Embed security at code creation time Shift AppSec checks into the IDE and CI pipeline so vulnerable code is analysed while the developer still has context for fixing it.
- Harden developer identity and registry access Require strong authentication, scoped credentials, and explicit approval paths for package registries, source control, and build systems.
- Validate AI findings with deterministic controls Use SAST, SCA, and IaC analysis to confirm or refute AI-generated findings before they are routed for remediation.
Bottom line: AI-generated code is changing AppSec by increasing vulnerability density and reducing the time available for review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:49 pm
AI-generated code has turned AppSec into a speed-matching problem. Traditional review models assume security can examine code after developers finish writing it. That assumption breaks when code is produced continuously, by assistants that do not carry organisational risk context. The practical consequence is that security must move into the creation path, not wait for downstream validation.
A question worth separating out:
Q: How do AppSec and identity controls work together in AI coding workflows?
A: AppSec finds flaws in the code, while identity controls protect the systems that create and distribute that code. In AI coding workflows, both matter because access to source control, registries, and build systems determines whether risky code can be introduced at scale.
👉 Read our full editorial: AI-generated code is outpacing appsec controls, and attackers know it