Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: AI-assisted teams are shipping 3 to 4 times more commits but also 10 times more security findings, according to Apiiro, as AI-generated code accelerates AppSec risk faster than human review can keep up. Prevention at the prompt level is becoming the decisive control point, because detection-heavy workflows cannot reliably stop issues before they are written into code.
NHIMG editorial — based on content published by Apiiro: AI-generated code demands security controls before the first line
By the numbers:
- Those same teams also ship 10 times more security findings, according to Apiiro's analysis.
- More than 25% of new code at Google was AI-generated in Q3 2024, rising to roughly 50% by Q4 2025, according to Apiiro.
Questions worth separating out
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: Why do AI coding assistants increase AppSec governance risk?
A: They increase risk because they optimise for speed and plausible output, not for context-aware security validation.
Q: How can AppSec teams tell whether their controls are keeping pace with AI delivery?
A: Look for signals such as shrinking triage backlog, faster validation cycles, and a complete inventory of AI-enabled features, endpoints, and data flows.
Practitioner guidance
- Embed policy at generation time Configure AI coding workflows so security rules, approved patterns, and architecture context influence output before code is generated, not after it is merged.
- Extend NHI governance into development Track service accounts, API keys, and tokens created or referenced in AI-generated code as governed identities with ownership, scope, and rotation requirements.
- Prioritise prevention over post-code detection Keep SAST and SCA in place, but move higher-confidence controls upstream so insecure patterns are blocked before review queues and deployment pipelines.
What's in the full article
Apiiro's full research covers the operational detail this post intentionally leaves for the source:
- How Guardian Agent rewrites prompts with security guidelines, threat context, and architecture signals before generation
- The software graph and deep code analysis inputs the vendor uses to tailor guidance to real application and infrastructure context
- How the prompt-level workflow fits into existing developer environments without changing the broader delivery process
- Examples of the architecture-aware security context the vendor says it applies inside AI coding workflows
👉 Read Apiiro's analysis of how AI-generated code is changing AppSec →
AI-generated code security: are your controls keeping pace?
Explore further
14/09/2026 10:11 am
AI-generated code turns AppSec into a prevention problem, not a detection problem. The old model assumed that security could inspect code after a human had time to create and review it. That assumption weakens when code generation becomes machine-speed and vulnerabilities are introduced before a manual gate can intervene. The governance implication is that prevention must move into the generation workflow itself, or security will always trail production output.
A question worth separating out:
Q: Should organisations prioritise prompt-level security over traditional code scanning?
A: They should prioritise prompt-level prevention for high-risk patterns while keeping scanning in the toolchain. Scanning still matters, but it cannot be the primary defense when code is generated too quickly for manual review to keep pace. The best model combines upstream policy with downstream verification.
👉 Read our full editorial: AI-generated code demands security controls before the first line
