Notifications
Clear all
Topic starter
20/08/2026 5:23 pm
TL;DR: AI-assisted development is accelerating code output faster than traditional AppSec review can absorb, with Arnica citing that up to 30% of modern code is now AI-generated and 90% of developers use AI tools daily. The governance issue is not whether AI writes code, but whether enterprises can enforce secure-by-default controls before risky code reaches production.
NHIMG editorial — based on content published by Arnica: Making AI Work in Your Enterprise, a webinar recap on vibe coding and enterprise security
By the numbers:
- 30% of modern code is now AI-generated, erated, according to Arnica.
Questions worth separating out
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: Why does AI-assisted development complicate application security governance?
A: AI-assisted development complicates governance because the organisation must track who authorised the change, what system generated it, and whether the output can be audited.
Q: What do organisations get wrong about scanning AI-generated code?
A: The common mistake is treating more scanning as a complete answer.
Practitioner guidance
- Embed security policy into AI coding workflows Define secure coding constraints directly in IDE assistants, code generation tools, and review automation so unsafe patterns are blocked before merge.
- Treat AI-generated code volume as a control-capacity metric Measure whether scan, review, and triage capacity can keep pace with AI-assisted output, then adjust staffing and automation before backlog becomes normal.
- Review repository and pipeline permissions together Audit who and what can access source control, CI/CD, build secrets, and assistant-connected tools, then reduce standing privilege where it is not required.
What's in the full article
Arnica's full webinar recap covers the operational detail this post intentionally leaves for the source:
- How the webinar speakers frame vibe coding versus viable coding in day-to-day engineering practice
- Examples of agentic security rules used to shape AI-generated code before it reaches review
- The AI SAST workflow details that show how contextual fixes are suggested during development
- The webinar replay for teams that want the founders' implementation perspective rather than the governance view
👉 Read Arnica's webinar recap on making vibe coding viable in the enterprise →
AI-generated code in appsec: what enterprises need to control?
Explore further
20/08/2026 6:13 pm
AI-assisted coding is creating a governance gap, not just a productivity gain. Enterprises are treating AI-generated code as an output problem when it is also a control problem. The same workflow that accelerates delivery can also accelerate policy drift, insecure patterns, and secret exposure. The practical conclusion is that AI coding governance has to sit inside the software delivery process, not beside it.
A question worth separating out:
Q: How do identity controls affect AI-assisted software delivery?
A: Identity controls determine who and what can access repositories, build systems, secrets, and deployment tooling. In AI-assisted delivery, that includes service accounts, tokens, and assistant-connected automation that may act with broad privileges. If those identities are over-scoped, the development pipeline itself becomes an easy path to production risk.
👉 Read our full editorial: AI-generated code is outpacing appsec review in enterprise teams
