Notifications
Clear all
Topic starter
02/08/2026 12:31 pm
TL;DR: AI-based tools are projected to be used by 90% of enterprise software engineers by 2028, up from less than 14% in early 2024, while Gartner warns that AI-native software engineering will require leaders to mitigate new risks and challenges. The security question is no longer whether teams adopt AI, but whether they can govern agentic workflows, code quality, and supply chain exposure at the pace AI introduces them.
NHIMG editorial — based on content published by Veracode: The AI-Native Era is Here: What this Gartner Innovation Insight Means for Your Software Security
By the numbers:
- AI code assistants are expected to be used by 90% of enterprise software engineers by 2028, up from less than 14% in early 2024.
Questions worth separating out
Q: How should security teams govern AI-enabled workflows that can act on their own?
A: Treat them as identity-governed execution paths, not just software features.
Q: Why do AI native workflows create more identity risk than traditional engineering models?
A: AI native workflows increase identity risk because they multiply the number of identities and shorten the time access remains stable.
Q: What do teams get wrong when they rely on human-in-the-loop controls for AI?
A: Teams often treat human-in-the-loop as a compliance checkbox, but the real test is whether the organisation understood the risk and placed controls around irreversible actions.
Practitioner guidance
- Bound AI actions by workflow class Classify AI-assisted tasks into advisory, draft, and change-making categories, then require explicit approval for any action that can alter code, infrastructure, or policy.
- Extend security gates to generated artefacts Apply SAST, SCA, configuration review, and policy checks to code and fixes produced by AI tools, not just human-authored changes.
- Track AI-originated change paths Tag commits, remediation actions, and configuration updates that originate from AI-assisted workflows so audit teams can reconstruct how a change was created and approved.
What's in the full article
Veracode's full article covers the strategic implications this post intentionally leaves for the source:
- How the Gartner report frames AI-native software engineering across the SDLC and why that changes security planning
- Veracode's own view of secure AI-assisted remediation and where human review sits in the workflow
- The article's discussion of developer productivity, agentic workflows, and the operational risks they create
- Context on how Veracode positions AI inside its SAST, DAST, and SCA remediation approach
👉 Read Veracode's analysis of the Gartner report on AI-native software engineering →
AI-native software engineering: are your security controls keeping up?
Explore further
02/08/2026 1:28 pm
AI-native engineering creates governance debt before it creates productivity gain. The security programme now has to absorb faster code creation, faster remediation, and faster context transfer between tools. That means the control model must move from periodic review to continuous governance of machine-assisted change. Practitioners should treat the AI-native SDLC as an operational risk surface, not a productivity-only initiative.
A question worth separating out:
Q: How can teams reduce risk from AI-generated code in supply chains?
A: Teams should apply the same provenance and review expectations to AI-generated code as they do to third-party dependencies. That means verifying source, tightening review on generated changes, and blocking untrusted artifacts from reaching deployment. The goal is to prevent automation from scaling uncertainty faster than governance can absorb it.
👉 Read our full editorial: AI-native software engineering raises new control gaps for security
