Topic starter
02/08/2026 12:22 pm
TL;DR: False positives, exploitability ranking and faster remediation are the real gains AI is bringing to application security testing, according to Veracode. AppSec pipelines need tighter triage because noisy findings still decide where scarce review effort goes.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “How AI is Transforming Application Security Testing”.
By the numbers:
- The average time to resolve vulnerabilities now exceeds 250 days, according to Veracode.
- One customer reported reducing their false positive rate from 40% to just 3%, according to Veracode.
- Veracode Fix has been shown to improve remediation speed by over 200%, according to Veracode.
Key questions
Q: Why do false positives slow down appsec and DevSecOps programmes?
A: False positives slow programmes because engineers stop trusting findings that do not reliably predict real risk.
Q: What breaks when application security testing is moved too late in the delivery cycle?
A: Late testing turns vulnerabilities into backlog, which increases alert fatigue and encourages teams to work around controls.
Q: How should security teams use AI in access decisions without losing governance?
A: Use AI for recommendation, triage, and pattern detection first, then keep human approval for privileged, exception-heavy, or business-sensitive access.
Practitioner guidance
- Re-baseline AppSec metrics around decision quality Track false positive rate, MTTR, fix rate and security debt together so leadership sees whether AI is improving governance or simply increasing throughput.
- Integrate AI-assisted review into developer workflows Place remediation guidance inside the IDE and pull request flow so developers receive context at the point of change rather than in a separate ticket queue.
- Unify findings before prioritising risk Correlate SAST, DAST and SCA outputs into one view so exploitability, architecture context and business impact can be assessed consistently.
Bottom line: AI is changing AppSec because the governance problem has shifted from finding vulnerabilities to deciding which ones deserve scarce remediation capacity.
Glossary terms: Identity Security Posture Management, False Positive, Security Debt, DevSecOps
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:22 pm
AI is becoming an AppSec governance layer, not just a detection feature. The article’s core issue is not whether scanners can find more flaws, but whether security programmes can make faster, better decisions from the flood of findings. That changes AppSec from a tool-output problem into a policy, workflow and accountability problem. The practitioner conclusion is that AI belongs inside the governance model for how software risk is prioritised.
A question worth separating out:
Q: What do teams get wrong about AI-generated remediation suggestions?
A: They often treat the suggestion itself as authoritative. In practice, machine-generated fixes still need validation against coding standards, environment context, and security requirements. The risk is not only bad code, but also overconfidence in automation that has not been curated or tested for the organisation’s own patterns.
👉 Read our full editorial: AI reduces AppSec noise and shifts focus to risk decisions
This post was modified 2 days ago by NHI Mgmt Group