Topic starter
11/11/2026 5:59 pm
TL;DR: AI-assisted coding is pushing review demand beyond security capacity, ProjectDiscovery reports, with only 38% of teams comfortably keeping up. Security programmes now need stronger evidence-based triage and faster validation paths to handle the volume.
Editorial analysis by NHI Mgmt Group, based on content published by ProjectDiscovery: “The Trust Gap Behind the AI Coding Boom: What 200 Security Practitioners Just Told Us”.
By the numbers:
- 100% of respondents said engineering delivery has gotten faster in the last twelve months.
- Only 38% of the security teams in the survey said they're comfortably keeping up with the resulting code volume.
- 66% of respondents said more than half of their working week goes to manually validating and reproducing findings before anything can be prioritised or routed.
Key questions
Q: Why do AI coding tools increase secrets risk?
A: AI coding tools increase secrets risk because they can accelerate the reuse of insecure patterns across repositories, test fixtures, and automation scripts.
Q: How should security teams reduce repetitive false positives in SAST programs?
A: Start by encoding the context your scanner cannot infer reliably.
Q: How should security teams use AI-assisted code review safely?
A: Use it as a triage layer that accelerates first-pass detection, then require a separate validation step for findings that affect access control, authentication, secrets, or release gating.
Practitioner guidance
- Separate validation from detection queues Create distinct triage lanes for low-confidence scanner output, reproducible findings and release-blocking issues so manual effort is reserved for decisions that change risk.
- Tighten secrets governance around AI-generated code Require automated secret detection, immediate revocation paths and ownership tracking for any credential surfaced in pull requests or generated files.
- Use evidence-based prioritisation for exploitability checks Standardise what proof is needed before a finding can be escalated, and capture that proof in a repeatable format developers and approvers can review quickly.
Bottom line: AI-assisted coding is shifting appsec from a detection problem to a validation problem, because the security team must now decide faster which findings deserve human effort.
Glossary terms: AI-assisted coding, Secrets Exposure, Business logic vulnerability, Software Composition Analysis
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
AI-assisted coding has turned security review into a throughput problem, not a pure detection problem. The practical limit is no longer whether teams can find issues in code, but whether they can validate enough of them fast enough to influence release decisions. That changes appsec from a scanning function into a governance function that must triage risk under time pressure. The practitioner conclusion is straightforward: review capacity is now a design constraint.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should security leaders measure when AI-assisted coding slows review?
A: Security leaders should measure review latency, defect escape rate, rule violations, and the amount of human rework needed to validate AI-generated code. Track how often reviewers must inspect insecure patterns such as hard-coded secrets, overbroad permissions, unsafe deserialisation, or missing input checks, and whether code scanning, policy gates, and protected branching still catch them before merge.
👉 Read our full editorial: AI-assisted coding outpaces security validation in appsec teams