Topic starter
01/08/2026 9:00 pm
TL;DR: AI coding assistants are helping teams write code two to three times faster, while vulnerability backlogs can triple and exploitable flaws can rise roughly 5x, according to Checkmarx. The practical answer is not AI or deterministic AppSec, but a hybrid model that preserves trusted validation, remediation throughput, and governance at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Learnings From Checkmarx Agentic AppSec Unleashed ‘26”.
By the numbers:
- In Checkmarx labs, the hybrid engine reached an F1 score of 0.64, compared to roughly 0.20 for a pure frontier model like Claude Opus 4.7.
Key questions
Q: How should security teams govern AI-generated mobile code without slowing delivery?
A: Use a tiered model that matches AI use to risk.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale.
Q: What breaks when AppSec relies only on LLM-based analysis?
A: LLM-only analysis can miss known critical issues, produce inconsistent results, and create false positives that developers stop trusting.
Practitioner guidance
- Separate code generation from security validation Keep the system that produces code distinct from the control plane that validates security findings, so the same model is never its own judge.
- Prioritise remediation throughput over alert volume Track mean time to remediation, not just findings discovered, and use that measure to expose whether AI-driven delivery is outrunning fix capacity.
- Add deterministic confirmation to AI-assisted triage Require repeatable rule-based confirmation before a finding can block release or enter an audit trail, especially for high-confidence vulnerabilities.
Bottom line: AI-generated code is not only increasing delivery speed, it is also widening the gap between what AppSec finds and what teams can fix.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:07 pm
Deterministic control is becoming the governance boundary for AI-generated software. AI can expand coverage and speed, but it cannot be the final arbiter of whether a finding is real, repeatable, and actionable. Once code is created at machine speed, the security function that matters most is not more noise, but trusted validation that can survive audit, change review, and operational pressure.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Developers using GenAI tools like GitHub Copilot are reporting 35% productivity gains, according to IDC’s 2024 Generative AI Study.
A question worth separating out:
Q: Should organisations treat AI-generated code as a separate governance category?
A: Yes, because AI-generated code introduces a trust problem that sits between development, application security, and identity governance. Teams need policy for what AI may generate, how outputs are validated, and how identities and secrets are handled in the resulting code. Without that, responsibility for unsafe behaviour becomes fragmented across teams.
👉 Read our full editorial: Agentic appsec needs deterministic controls to match AI code speed