Notifications
Clear all
Topic starter
02/08/2026 12:15 pm
TL;DR: As AI-assisted coding reaches 99% of development teams but only 29% have formal AI security controls, post-commit scanning is missing a growing share of risk introduced at code creation, according to Checkmarx. The control point is shifting into the IDE, where intent, dependencies, secrets, and unsafe patterns must be validated in real time before code reaches the repository.
NHIMG editorial — based on content published by Checkmarx: GenAI is reshaping the software supply chain and creating a new AppSec gap
By the numbers:
- 99% of development teams now use AI-assisted coding tools, while only 29% have implemented formal AI security controls.
Questions worth separating out
Q: How should security teams govern AI-assisted coding tools in the IDE?
A: They should treat AI-assisted coding tools as part of the control surface, not just a developer convenience.
Q: Why do AI-generated code pipelines create more security risk than traditional development?
A: They compress the time between defect creation, discovery, and exploitation.
Q: What do security teams get wrong about post-commit AppSec scanning?
A: They often assume post-commit scanning is the primary control, when it is actually a late-stage detection layer.
Practitioner guidance
- Implement IDE-level security validation Add controls that inspect code as it is typed or generated, with checks for insecure APIs, dangerous defaults, and risky dependency suggestions before commit.
- Inventory and sanction AI coding assistants Document which assistants are approved, which teams are using them, and where shadow AI is already present.
- Extend secrets and dependency scanning to generated code Apply SCA and secrets detection to AI-produced snippets, not just to repository commits, so hidden packages and exposed credentials are identified in the authoring flow.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- Examples of insecure defaults and logic flaws that AI-generated code can introduce before commit
- The article's breakdown of post-commit scanning latency and why it fails in AI-assisted workflows
- Operational guidance on shifting controls into the IDE and validating intent as code is written
- Checkmarx's discussion of shadow AI and governance drift across developer teams
👉 Read Checkmarx's analysis of AI-generated code and the new AppSec gap →
AI-generated code and the AppSec gap teams are missing?
Explore further
02/08/2026 1:17 pm
AI-assisted coding has created an upstream governance problem, not just a coding-quality problem. Once generation becomes part of the software supply chain, security policy has to move to the point where code is created, not where it is finally reviewed. Post-commit controls still matter, but they now sit too late in the lifecycle to catch the full class of AI-introduced issues. The practitioner conclusion is straightforward: control the creation layer or accept blind spots.
A question worth separating out:
Q: How can organisations prove their AI controls are actually working?
A: Look for evidence that policy decisions are logged, sensitive prompts are being redacted or blocked when required, and approved AI interactions are traceable by identity and business context. Effective programmes produce audit-ready records, not just policy text. If the control cannot explain what happened in a session, it is not operational enough.
👉 Read our full editorial: GenAI code creation is creating a new AppSec gap
