Notifications
Clear all
Topic starter
18/08/2026 2:23 pm
TL;DR: AI-assisted development is creating code and architectural change faster than traditional reactive AppSec models can absorb, according to Apiiro's interview with Thomas Dohmke. The core shift is toward preventative guardrails before deployment, because AI-driven velocity expands dependencies, integrations, and exploitable surface area faster than late-stage remediation can manage.
NHIMG editorial — based on content published by Apiiro: an interview with Thomas Dohmke on AI's impact on application security
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Embed secure code guardrails in AI-assisted pipelines Define policy checks, dependency allowlists, and secret-detection gates before code can merge or deploy.
- Inventory machine identities created by development tooling Map every token, API key, certificate, and service account used by AI-enabled development workflows.
- Shift AppSec review earlier in the architecture lifecycle Require architectural review for new AI-assisted services before code generation begins, especially where the design introduces new integrations, privileged workflows, or data access paths.
What's in the full article
Apiiro's full interview covers the operational detail this post intentionally leaves for the source:
- Thomas Dohmke's direct commentary on how AI changes developer velocity and security operating models
- The interview framing around Guardian Agents and orchestration of AI-powered security workflows
- Apiiro's perspective on securing AI before code generation rather than relying on runtime discovery
- The broader discussion of how application security teams can preserve speed while adding preventative controls
👉 Read Apiiro's interview on AI-driven code generation and AppSec guardrails →
AI-generated code and AppSec guardrails: are teams keeping up?
Explore further
18/08/2026 3:14 pm
AI-generated code has turned application security into a governance problem, not just a scanning problem. Static and runtime controls still matter, but they are no longer sufficient when code, dependencies, and integrations are produced at machine speed. The practical issue is that risk now accumulates before the traditional review window opens, which means security has to govern how software is created, not only how it behaves in production. Practitioners should treat AI-assisted development as a control design challenge, not a tooling upgrade.
A question worth separating out:
Q: Who should be accountable when an AI agent causes a security incident?
A: Accountability should sit with the human owner, platform team, or business function that granted and operated the agent. The identity may act independently, but governance cannot detach responsibility from the delegation chain. Programs should define ownership, escalation, and remediation paths before deployment so responsibility is clear when the agent's behaviour changes.
👉 Read our full editorial: AI-generated code is outpacing reactive AppSec controls
