Notifications
Clear all
Topic starter
02/08/2026 11:54 am
TL;DR: AI-generated code is accelerating software delivery while also increasing latent vulnerabilities, dependency sprawl, and remediation backlog pressure, according to Veracode. The critical shift is that insecurity is becoming a throughput problem, so security must scale as a continuous control system rather than a late-stage review step.
NHIMG editorial — based on content published by Veracode: AI, Application Security, and the Illusion of Control
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What do security teams get wrong about secure-by-design AI governance?
A: They often treat secure-by-design as a policy label instead of an enforceable operating model.
Practitioner guidance
- Enforce policy at the code generation boundary Block insecure patterns before merge by using approved templates for authentication, access checks, logging, and secret handling in AI-assisted workflows.
- Measure risk velocity, not just vulnerability counts Track how many issues are introduced per release, how long they remain open, and whether remediation throughput keeps pace with AI-driven code production.
- Tie secrets governance to the SDLC Inventory where API keys, tokens, and certificates can be introduced by generated code, then require secret scanning, rotation, and workload identity substitution before deployment.
What's in the full article
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- Specific examples of insecure code patterns that AI tends to reproduce in developer workflows
- The article's discussion of how organisations should rethink shift-left when code production outpaces review capacity
- Veracode's perspective on how AI can also help generate patches and guide remediation
- The broader argument for treating secure-by-design as an engineering platform decision rather than a campaign
👉 Read Veracode's analysis of AI-generated code and application security risk →
AI-generated code and the application security governance gap?
Explore further
02/08/2026 1:02 pm
AI-generated code is turning application security into a risk velocity problem. The core issue is no longer whether insecure code can be found. It is whether organisations can detect and remove it faster than AI-assisted development creates it. That shifts the centre of gravity from point-in-time review to continuous control, especially where secrets, access logic, and dependency decisions are embedded directly into code. Practitioners should treat security debt as an operational metric, not an abstract concern.
A question worth separating out:
Q: How do organisations know whether AI-assisted development is staying secure?
A: Measure the share of AI-generated changes that pass security checks on the first review, the number of risky dependencies blocked before install, and the time taken to remediate findings that escaped into branches or test environments. If those numbers worsen as adoption grows, the programme is scaling risk faster than control coverage.
👉 Read our full editorial: AI-generated code is widening risk velocity in application security
