Topic starter
01/08/2026 10:42 pm
TL;DR: AI-assisted development is driving a trust gap in AppSec: Veracode says 45% of AI-generated code contains known security vulnerabilities without guidance, while 82% of organisations carry security debt and 60% of that debt is critical. Scanning still matters, but software trust now depends on provenance, continuous verification, remediation, and auditable governance.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “The Best Application Security Testing Tool Isn’t a Scanning Tool Anymore”.
By the numbers:
- 45% of AI-generated code contains known security vulnerabilities when no security guidance is provided, according to Veracode research.
- 82% of organizations now carry security debt, according to Veracode's 2026 State of Software Security Report.
- 60% of those organizations have debt classified as critical, according to Veracode's 2026 State of Software Security Report.
Key questions
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why does security debt become more dangerous in AI-accelerated development?
A: Because the rate of code creation rises faster than the rate at which teams can review and fix defects.
A: When vulnerability management stops at detection, teams inherit a growing queue of findings with no reliable path to closure.
Practitioner guidance
- Establish code provenance controls Track whether code was human-written, AI-assisted, or machine-generated, and require that lineage be visible at review and release time.
- Shift from point-in-time scans to continuous verification Verify that deployed artefacts match approved builds and that high-risk changes cannot drift between approval and production.
- Create a security debt burn-down process Assign ownership for unremediated vulnerabilities, set age-based escalation rules, and report debt separately from raw findings.
Bottom line: AI-generated code is pushing application security beyond scanner performance and into governance, provenance, and remediation control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:52 pm
Software trust is becoming the real security boundary for application delivery. Detection still matters, but detection without governed remediation only increases backlog. In AI-assisted development, the decisive question is whether teams can prove that code was introduced, reviewed, and released under controlled conditions. Practitioners should treat trust as an operational control, not a slogan.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations prioritise provenance and attestation over faster scanning?
A: Yes, when AI-assisted delivery is already increasing code volume faster than teams can inspect it. Faster scanning still helps, but it does not answer the assurance question that boards, regulators, and customers increasingly care about. Provenance and attestation provide evidence that code was controlled, not just inspected.
👉 Read our full editorial: AI-generated code is redefining what application security tools must do