Topic starter
20/08/2026 5:36 pm
TL;DR: AI code security risk is now the dominant developer concern, with 57% worried about exposing sensitive company or customer data while only 37% of organisations have tightened code security practices, according to Sonar’s State of Code Developer Survey. The pattern points to a verification gap, not just an adoption gap: teams are generating faster than they can reliably review.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “Managing the tricky relationship between AI and code security”.
By the numbers:
- 57% of developers worry that using AI risks exposing sensitive company or customer data.
- Only 37% of organisations have become more rigorous about code security because of AI.
- Teams juggle an average of four different AI tools, and 35% of that usage happens through personal, ungoverned accounts.
Key questions
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why do personal AI accounts create governance risk in software teams?
A: Personal accounts break visibility, ownership, and policy enforcement.
Q: How should financial institutions verify AI-assisted code before release?
A: They should place automated verification in the development path, not after it.
Practitioner guidance
- Implement deterministic verification in CI/CD Place static analysis, dependency scanning, policy checks, and secure code review gates between AI-assisted generation and merge approval.
- Inventory AI tools and account usage Identify every approved and unapproved AI coding tool, then map usage to managed corporate identities rather than personal accounts.
- Set governance rules for AI-generated code Define what code can be generated, what must be reviewed manually, and which sensitive repositories or data types are out of scope for external AI tools.
Bottom line: AI-assisted development is creating a verification gap, where code can look correct while still carrying security and reliability defects.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:22 pm
AI-generated code has become a governance issue before it becomes a productivity issue. The survey data shows developers are worried about security exposure while organisations have not matched that concern with tighter controls. That gap matters because the risk is not only bad code, but unverified code entering release pipelines under a false assumption of safety. Practitioners should treat AI-assisted development as a control design problem, not a tooling preference.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: When should teams restrict AI tools in development workflows?
A: Teams should restrict AI tools whenever they cannot be tied to managed identities, approved storage, and auditable usage. If the organisation cannot see where prompts, outputs, and code changes flow, the toolchain is operating outside acceptable governance. That is especially important for regulated data, sensitive repositories, and high-impact production systems.
👉 Read our full editorial: AI code security risk is outpacing enterprise governance