Topic starter
02/08/2026 12:31 pm
TL;DR: AI-native software engineering is pushing agentic workflows, autonomous tasks, and AI code assistants into the SDLC, with Veracode citing Gartner’s view that leaders must mitigate new risks while adoption is projected to reach 90% of enterprise software engineers by 2028. The security problem is shifting from code generation speed to governance of AI outputs, workflow trust, and supply chain exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “The AI-Native Era is Here: What this Gartner® Innovation Insight Means for Your Software Security”.
By the numbers:
- 90% of enterprise software engineers are projected to use AI code assistants by 2028, up from less than 14% in early 2024.
Key questions
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why does AI make software supply chain risk harder to control?
A: AI increases the amount of code produced, which reduces the time available for review and makes malicious or unauthorized changes harder to spot.
Q: How do security teams know whether AI-assisted remediation is actually under control?
A: Look for three signals: human approval still exists before code creation, pull requests identify machine-authored changes clearly, and deployment permissions are not inherited from build status alone.
Practitioner guidance
- Define review gates for AI-assisted changes Classify security-sensitive changes, such as authentication, authorisation, infrastructure configuration, and dependency updates, so they always require explicit human review before merge or deployment.
- Extend supply chain checks to AI-generated code Run SAST, SCA, and configuration validation on AI-produced output exactly as you would on human-written code, with special attention to hidden dependencies and duplicate logic.
- Track provenance for agentic workflow outputs Record which prompt, model, tool call, and approval path produced a change so teams can trace how context moved through the workflow if a defect appears later.
Bottom line: AI-native software engineering changes the control problem by introducing machine-driven actions into parts of the SDLC that were built around human review and approval.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:28 pm
AI-native development is now an identity and governance problem, not just an application security problem. When tools can generate, modify, and propagate code context inside a workflow, the organisation is no longer managing only developer productivity. It is managing delegated action inside a software supply chain that needs clear authority, review, and accountability. Practitioners should treat AI-assisted development as a governed identity-and-control surface.
A question worth separating out:
Q: Should organisations treat agentic workflows differently from standard developer tooling?
A: Yes, because agentic workflows can act across multiple steps and tools rather than only suggesting a change. That means authority, context transfer, and approval become part of the security design. Organisations should govern the workflow itself, not just the final code it produces.
👉 Read our full editorial: AI-native software engineering raises new control gaps for security