Notifications
Clear all
Topic starter
01/08/2026 9:00 pm
TL;DR: AI coding assistants are helping teams write code two to three times faster, while vulnerability backlogs can triple and exploitable flaws can rise roughly 5x, according to Checkmarx. The practical answer is not AI or deterministic AppSec, but a hybrid model that preserves trusted validation, remediation throughput, and governance at machine speed.
NHIMG editorial — based on content published by Checkmarx: Agentic AppSec Unleashed Summit analysis
By the numbers:
- In Checkmarx labs, the hybrid engine reached an F1 score of 0.64, compared to roughly 0.20 for a pure frontier model like Claude Opus 4.7.
Questions worth separating out
Q: How should security teams manage AppSec when AI is writing code faster than humans can review it?
A: Teams should shift from discovery-centric reporting to remediation-centric governance.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What breaks when AppSec relies only on LLM-based analysis?
A: LLM-only analysis can miss known critical issues, produce inconsistent results, and create false positives that developers stop trusting.
Practitioner guidance
- Measure remediation throughput, not just discovery volume Track mean time to remediation, backlog age, and the percentage of critical findings closed inside the release cycle.
- Keep deterministic validation as the final decision layer Use AI to enrich, explain, and prioritise findings, but require repeatable scanners or rules-based checks before a vulnerability can be marked exploitable, waived, or closed.
- Separate code generation from security authority Do not let the same model, agent, or workflow create code and approve its own security posture.
What's in the full article
Checkmarx's full summary covers the operational detail this post intentionally leaves for the source:
- Session-level examples of how teams are using agents for triage, fix generation, and backlog reduction across the SDLC
- Benchmark details behind the hybrid deterministic plus AI model, including fidelity comparisons and false-positive reduction results
- Practitioner discussion on how security leaders are combining code analysis, runtime context, and identity signals before approving remediation
- Supply-chain governance detail on AI components, MCP servers, and unsanctioned tooling that the summit only introduced at a high level
👉 Read Checkmarx's analysis of agentic AppSec and AI-driven remediation →
AI-generated code is outpacing AppSec. What should teams change?
Explore further
01/08/2026 9:07 pm
Deterministic validation is now the trust anchor for AI-era AppSec: LLMs can accelerate analysis, but they cannot be the only system deciding what is real, what is exploitable, and what should be remediated. The article makes the right architectural distinction between probabilistic assistance and repeatable control. For security programmes, the practitioner conclusion is to treat deterministic logic as the evidence layer that AI must never override.
A question worth separating out:
A: They should treat those agents as governed non-human identities. Inventory their permissions, separate creation from approval, and limit their access to the smallest set of repositories, registries, and deployment paths needed for the task.
👉 Read our full editorial: Agentic appsec needs deterministic controls to match AI code speed
