Topic starter
02/08/2026 12:24 pm
TL;DR: AI-generated code now touches most development teams, while 74% of organisations still carry critical flaws that can persist for months or years, according to Veracode and the 2025 State of Software Security Report. Fragmented toolchains and slow remediation are becoming the real bottleneck, not development speed.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “Revolutionizing DevSecOps with AI-Powered Application Security”.
By the numbers:
- 76% of developers currently use or plan to use AI tools to write code.
- 74% of organisations still carry critical flaws that persist for months or years, according to the 2025 State of Software Security Report cited by Veracode.
- The article says organisations using AI-assisted remediation see 92% faster mean time to remediation.
Key questions
Q: Why do fragmented security tools create DevSecOps friction?
A: Fragmented tools create duplicate alerts, inconsistent severity scoring, and disconnected ownership, which forces engineers to spend time interpreting findings instead of fixing them.
Q: Why does AI-assisted coding increase security debt if controls stay manual?
A: Because code volume rises faster than review, testing, and remediation capacity.
Q: What happens when remediation guidance is not built into developer workflows?
A: When remediation guidance is not built into developer workflows, fixes are slower, less consistent, and more likely to stall in the backlog.
Practitioner guidance
- Implement a unified application security posture view Correlate SAST, DAST, SCA, runtime, and policy findings into one operating view so teams can prioritise by application criticality and release risk.
- Embed AI-assisted remediation into the IDE Provide fix recommendations where developers write code, and track whether suggested changes are accepted, modified, or rejected.
- Reduce false-positive churn before adding more scanners Measure how much analyst time is spent triaging duplicates and low-value alerts, then tune or remove sources that do not improve decision quality.
Bottom line: AI-assisted coding is widening the gap between development throughput and security control capacity, so unresolved flaws can accumulate even when teams are highly active.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:24 pm
AI-assisted development has turned application security into a throughput problem. The article is right to frame the issue as economics, not just tooling. When code volume rises faster than review and remediation capacity, security debt accumulates regardless of how many scanners are deployed. Practitioners should treat this as a governance scaling issue, not a point-product selection problem.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: When should organisations prioritise AI-powered application security over adding more point tools?
A: When their current stack creates duplicated findings, slow triage, and inconsistent policy decisions across pipelines. More tools rarely fix a coordination problem. Organisations should prioritise the control layer that connects detection, prioritisation, and remediation before expanding tool count further.
👉 Read our full editorial: AI-powered application security is changing DevSecOps economics