Notifications
Clear all
Topic starter
06/09/2026 9:34 am
TL;DR: AI coding tools are now mainstream in enterprise development, with about 90% of Fortune 100 companies using them and 40% to 50% of code in many environments being AI-generated, according to Arxan Technologies. The security implication is that faster code creation is compressing the window between vulnerability introduction and exploitation, making continuous application protection more urgent than periodic review.
NHIMG editorial — based on content published by Arxan Technologies: The Fourth Wave: When AI Writes the Code and Hacks It
By the numbers:
- ~90% of Fortune 100 companies are using AI coding tools.
- ~40–50% of code is now AI-generated in many environments.
- 83% of applications are under constant attack, according to the vendor's 2025 threat report.
Questions worth separating out
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: Why do AI-assisted attacks reduce the value of traditional patching windows?
A: Because AI can compress reconnaissance, exploit development, and adaptation into a much shorter timeline than manual attacker workflows.
Q: What breaks when mobile runtime protection is missing?
A: Attackers gain a cleaner path to study and manipulate the app in real time, which makes reverse engineering, hook-based probing, and certificate interception much easier.
Practitioner guidance
- Embed security checks into AI-assisted development workflows Add policy and validation steps into coding copilots, pull requests, and CI/CD gates so insecure patterns are flagged before merge, not after deployment.
- Prioritise runtime protection for internet-facing applications Deploy obfuscation, anti-tampering, and RASP where exposed applications are likely to be probed continuously and cannot rely on perimeter controls alone.
- Inventory pipeline identities and secrets Map developer accounts, service accounts, tokens, and API keys that enable code build and release, then reduce standing access and tighten rotation.
What's in the full article
Arxan Technologies' full blog covers the operational detail this post intentionally leaves for the source:
- Specific application self-protection mechanisms, including obfuscation, anti-tampering, and runtime application self-protection implementation patterns.
- The article's own threat and attack-rate data by industry, which can support board reporting and appsec prioritisation.
- Additional discussion of how AI-generated code changes release governance, testing bottlenecks, and security accountability in large software organisations.
👉 Read Arxan Technologies' analysis of AI-driven code generation and application attack speed →
AI-generated code and attack speed: what security teams need to know?
Explore further
06/09/2026 9:34 am
AI has turned application security into a speed problem, not just a vulnerability problem. The article is right to emphasise that the window between code creation and exploitation is collapsing. That means security programmes that still depend on periodic review are structurally behind the threat. The operational question is how to enforce controls at the same pace as code generation and attack automation.
A question worth separating out:
Q: What does this shift mean for application security and IAM teams?
A: It means application security and IAM can no longer operate as separate workstreams. AI-generated code still depends on identities, secrets, and release permissions, so governance must cover the code path and the identity path together. Otherwise, the same acceleration that helps developers also helps attackers.
👉 Read our full editorial: AI writes code faster, but application security is falling behind
