Topic starter
02/08/2026 11:54 am
TL;DR: AI-generated code is accelerating software delivery while also increasing latent vulnerabilities, dependency sprawl, and remediation backlog pressure, according to Veracode. The critical shift is that insecurity is becoming a throughput problem, so security must scale as a continuous control system rather than a late-stage review step.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “AI, Application Security, and the Illusion of Control”.
Key questions
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What do security and engineering teams get wrong about AI-assisted development?
A: They often confuse faster output with better control.
Practitioner guidance
- Implement risk velocity tracking Measure the rate at which new vulnerabilities, insecure dependencies, and security exceptions are created versus closed in each delivery stream.
- Enforce secure coding guardrails in pipelines Convert authentication, input handling, logging, and dependency rules into executable checks that block unsafe AI-generated code before merge.
- Tighten software composition controls Require approved dependency sources, lockfiles, and package provenance checks so generated code cannot introduce unmanaged libraries.
Bottom line: AI-generated code is not just creating more software, it is increasing the pace at which insecure patterns, unsafe dependencies, and security debt enter the environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:02 pm
Risk velocity is now the more useful application security metric than raw vulnerability count. When code production accelerates, backlog size alone stops telling the full story. What matters is whether the organisation can reduce risk as quickly as it creates it. That reframes governance from reporting exposure to managing the rate of exposure creation and closure. Practitioners should treat risk velocity as the operational signal that security capacity is lagging engineering throughput.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations govern AI tools that analyse source code?
A: Set evidence thresholds, require secondary validation for high-impact findings, and define who owns the final decision. Governance should cover prompt scope, output format, reviewer sign-off, and auditability. That keeps AI in an advisory role and prevents noisy model output from becoming an unreviewed security decision.
👉 Read our full editorial: AI-generated code is widening risk velocity in application security