Topic starter
02/08/2026 12:22 pm
TL;DR: AI is being used to reduce false positives, prioritise exploitability, and speed remediation in application security testing, while legacy SAST, DAST, and manual review workflows struggle to keep pace with CI/CD and microservices, according to Veracode. The real shift is not tooling automation alone, but whether AppSec programmes can turn noisy detection into risk-based governance without losing developer trust.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “How AI is Transforming Application Security Testing”.
By the numbers:
- The average time to resolve vulnerabilities now exceeds 250 days, according to Veracode.
- One customer reported reducing their false positive rate from 40% to just 3%, according to Veracode.
- Veracode Fix has been shown to improve remediation speed by over 200%, according to Veracode.
Key questions
Q: How should security teams use AI in access decisions without losing governance?
A: Use AI for recommendation, triage, and pattern detection first, then keep human approval for privileged, exception-heavy, or business-sensitive access.
Q: Why do false positives slow down appsec and DevSecOps programmes?
A: False positives slow programmes because engineers stop trusting findings that do not reliably predict real risk.
Q: What breaks when application security testing is moved too late in the delivery cycle?
A: Late testing turns vulnerabilities into backlog, which increases alert fatigue and encourages teams to work around controls.
Practitioner guidance
- Re-baseline AppSec metrics around decision quality Track false positive rate, MTTR, fix rate and security debt together so leadership sees whether AI is improving governance or simply increasing throughput.
- Integrate AI-assisted review into developer workflows Place remediation guidance inside the IDE and pull request flow so developers receive context at the point of change rather than in a separate ticket queue.
- Unify findings before prioritising risk Correlate SAST, DAST and SCA outputs into one view so exploitability, architecture context and business impact can be assessed consistently.
Bottom line: AI is changing AppSec because the governance problem has shifted from finding vulnerabilities to deciding which ones deserve scarce remediation capacity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:22 pm
AI is becoming an AppSec governance layer, not just a detection feature. The article’s core issue is not whether scanners can find more flaws, but whether security programmes can make faster, better decisions from the flood of findings. That changes AppSec from a tool-output problem into a policy, workflow and accountability problem. The practitioner conclusion is that AI belongs inside the governance model for how software risk is prioritised.
A question worth separating out:
Q: What do teams get wrong about AI-generated remediation suggestions?
A: They often treat the suggestion itself as authoritative. In practice, machine-generated fixes still need validation against coding standards, environment context, and security requirements. The risk is not only bad code, but also overconfidence in automation that has not been curated or tested for the organisation’s own patterns.
👉 Read our full editorial: AI is reshaping application security testing and AppSec governance