Notifications
Clear all
Topic starter
20/08/2026 5:36 pm
TL;DR: AI code security risk is now the dominant developer concern, with 57% worried about exposing sensitive company or customer data while only 37% of organisations have tightened code security practices, according to Sonar’s State of Code Developer Survey. The pattern points to a verification gap, not just an adoption gap: teams are generating faster than they can reliably review.
NHIMG editorial — based on content published by Sonar: State of Code Developer Survey findings on AI code security risk
By the numbers:
- 57% of developers worry that using AI risks exposing sensitive company or customer data.
- Only 37% of organisations have become more rigorous about code security because of AI.
- Teams juggle an average of four different AI tools, and 35% of that usage happens through personal, ungoverned accounts.
Questions worth separating out
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: Why do personal AI accounts create so much risk in enterprise environments?
A: Personal accounts bypass enterprise identity controls, so security teams lose visibility into who authorised access, what scopes were granted, and whether the session can be revoked.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Enforce enterprise-only AI access for development work Require managed corporate identities for all code-generation tools, disable personal account use for source code tasks, and log tool access centrally.
- Insert automated verification gates before merge and release Make static analysis, secret scanning, dependency checks, and security testing mandatory for AI-generated code before it reaches main branches or deployment pipelines.
- Track AI tool sprawl as a governance metric Inventory every AI tool used by engineering teams, identify which are approved, and measure how much usage occurs outside enterprise tenancy.
What's in the full report
Sonar's full report covers the operational detail this post intentionally leaves for the source:
- Chapter-level survey findings on how developers, juniors, and senior engineers differ in their AI security concerns.
- Breakdowns of AI-related toil, technical debt, and the review burden that follows AI-generated code.
- Data on direct and indirect prompt injection concerns across enterprise and SMB organisations.
- The report's discussion of agentic workflows and how they are changing developer accountability.
👉 Read Sonar's State of Code Developer Survey on AI code security risk →
AI-generated code and the governance gap teams are missing?
Explore further
20/08/2026 6:22 pm
AI code security has become a governance issue, not just a developer quality issue. When organisations let generative tools into the software lifecycle without stronger verification, they create a control gap that looks like productivity but behaves like risk accumulation. The problem is not the model alone. It is the absence of enforceable review, policy, and accountability across the workflow. Practitioners should treat AI-assisted development as a governed security process, not an informal productivity layer.
A question worth separating out:
Q: Should organisations prioritise AI code verification before expanding AI use?
A: Yes. Expansion without verification simply scales risk faster than control. Organisations should first establish automated analysis, review gates, and accountable ownership for AI-assisted code, then broaden adoption. That sequence reduces security debt instead of creating a larger backlog of hidden flaws.
👉 Read our full editorial: AI code security risk is outpacing enterprise governance
