Topic starter
01/08/2026 10:48 pm
TL;DR: A global survey of 2,350 CISOs, AppSec managers and developers across 14 countries found that 49% of production code is now AI-generated, 81% of organisations were breached twice or more in the past year, and only 9% fix more than 90% of vulnerabilities within 90 days, according to Checkmarx. The result is an AppSec model where detection is plentiful but risk still survives the decision chain.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Just Launched: The Future of Application Security in the Era of AI – 2027 Industry Outlook”.
By the numbers:
- 49% of production code is now AI-generated.
- 81% of organisations were breached twice or more in the past year.
- Only 9% of organisations fix more than 90% of vulnerabilities within 90 days.
Key questions
Q: Where does AppSec fail when teams can detect issues but still ship vulnerable code?
A: It fails at the decision layer between finding a vulnerability and enforcing remediation.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What are the signs that vulnerability remediation is not holding up in practice?
A: Warning signs include high recurrence rates, slow validation after fixes, and vulnerabilities that reappear after patches or configuration changes.
Practitioner guidance
- Map AI code risk to remediation throughput Track how much AI-generated code is entering production against the percentage of findings closed within the organisation’s service-level targets.
- Enforce release gates for known vulnerabilities Block promotion of code that still contains acknowledged high-risk findings unless an explicit exception process is approved by the right owner.
- Reduce feedback latency for developers Push findings into the IDE, pull request, and build stages while they are still actionable, and remove duplicate or low-value alerts that train teams to ignore security feedback.
Bottom line: AI-generated code has changed the AppSec baseline, but the larger failure is organisational. Detection is widespread, yet vulnerabilities still survive because remediation and enforcement are too slow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:57 pm
AI-generated code has turned AppSec into a governance problem, not just a tooling problem. The article shows that security visibility is no longer the limiting factor; organisational response is. When code authorship shifts toward AI and developers act more as editors, the old assumption that human review pace can keep up no longer holds. The practitioner conclusion is that control design must account for machine-paced code creation.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: Should organisations prioritise continuous security feedback over end-of-cycle checkpoints?
A: Yes, when development velocity is high and AI-generated code is common. Checkpoints can still help with governance, but they are too late if vulnerabilities are being introduced and shipped continuously. Continuous feedback only works when it is paired with clear release authority and fix accountability.
👉 Read our full editorial: AI-generated code and slow remediation are widening AppSec risk