Topic starter
02/08/2026 12:31 pm
TL;DR: Black Hat USA 2025 highlighted how AI, software supply chain risk, and cloud security are converging into a tougher governance problem, while Veracode’s GenAI Code Security Report found nearly half of AI-generated code samples failed security tests and 83% of organisations are using AI for software development. The practical lesson is that AI adoption is outpacing security assurance, so controls must shift from review at the end to governance across the pipeline.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “Securing the Digital Frontier: Key Themes from Black Hat USA 2025”.
Key questions
Q: How should teams prevent AI code scanners from becoming the primary security control?
A: Treat AI scanners as advisory, not authoritative.
Q: Why do software supply chain attacks create such broad impact?
A: They exploit trust relationships that are already built into delivery pipelines.
Q: Where does cloud security fail when identities and integrations are over-broad?
A: Cloud security fails when service accounts, delegated integrations and automation credentials have more access than the task requires and no one is watching their use continuously.
Practitioner guidance
- Implement security gates for AI-generated code Require automated scanning, secure coding policy checks and human review before AI-generated code reaches merge or release.
- Inventory and classify third-party dependencies Track package provenance, maintainers and update paths so risky components can be identified and removed quickly.
- Tighten ownership of cloud-facing identities Assign explicit owners to service accounts, integrations and delegated access paths across every cloud environment.
Bottom line: AI-generated code can move insecure patterns into delivery pipelines faster than manual review can catch them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:29 pm
AI-assisted development has created a secure-by-review illusion. Review after code generation assumes the unsafe output can be reliably caught at the end of the pipeline, but Black Hat themes show that volume and speed are breaking that assumption. When nearly half of AI-generated code samples fail security tests, the governance question becomes how to prevent insecure patterns from entering the delivery chain in the first place. Practitioners should treat model output as an input requiring policy enforcement, not as draft code that later becomes safe by inspection.
A question worth separating out:
A: Modern products depend on third-party libraries, APIs, CI/CD systems, and cloud infrastructure, so the attack surface extends far beyond source code. That creates exposure through compromised dependencies, insecure integrations, weak IAM policies, and misconfigured environments. Product security has to address these layers together, because attackers usually exploit the easiest trust boundary, not only the code itself.
👉 Read our full editorial: Black Hat 2025 exposed a widening AI, supply chain, and cloud risk gap