Topic starter
24/10/2026 8:50 pm
TL;DR: Application security built for human-paced code is no longer adequate, according to Armis, because machine-generated software, faster attack automation, and expanding backlog volumes leave too much exposure between creation and protection. The shift-zero model reframes success around eliminating the window in which flaws exist rather than finding them faster.
Editorial analysis by NHI Mgmt Group, based on content published by Armis: “Application Security Was Built for a World That No Longer Exists”.
Key questions
Q: What breaks when AppSec is treated as a late-stage scan?
A: Late-stage scanning misses the point where insecure code, hardcoded secrets, and risky dependencies enter the system.
Q: Why do model-generated code changes increase AppSec risk so quickly?
A: Model-generated code increases risk because it can introduce insecure patterns at a speed that outpaces manual review and creates repeated defects across many files or services.
Q: What are the signs that backlog-driven application security is failing?
A: Common signs include growing unresolved findings, repeated late discovery of the same classes of issues, and a widening gap between code creation and remediation.
Practitioner guidance
- Embed security at code creation Move policy checks, analysis, and guardrails into authoring and build workflows so insecure code is intercepted before it enters the backlog.
- Redefine security success metrics Track the share of risky code prevented from reaching production, not only the number of vulnerabilities found or closed.
- Prioritise contextual code analysis Use controls that reason about intent and behaviour, especially where generative tools or agentic workflows create code paths that templates do not anticipate.
Bottom line: Application security built around late-stage detection cannot keep pace with machine-generated code and automated attackers.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →