Notifications
Clear all
Topic starter
20/08/2026 5:51 pm
TL;DR: Application security risk is shifting in 2026 as Cycode reports that 92% of organisations are using or piloting AI coding assistants while 81% still lack full visibility into how AI is used across the SDLC, leaving AI-generated code as a major blindspot. The governance problem is no longer just insecure code, but the combination of broken access control, misconfiguration, supply chain exposure, and agent-driven execution paths that outpace traditional review models.
NHIMG editorial — based on content published by Cycode: Application Security Vulnerabilities to Watch out for in 2026
By the numbers:
- Broken access control was 100% prevalent in applications assessed in the OWASP Top 10 2025 release.
- In the first half of 2025, the National Vulnerability Database coordinated over 23,667 CVEs, an increase of 16% from a year prior.
- 92% of organisations are actively using or piloting, oting AI coding assistants, according to Cycode’s 2026 State of Product Security in the AI Era report.
Questions worth separating out
Q: How should security teams prevent broken access control in modern applications?
A: Security teams should move authorization out of scattered code and into a centrally governed policy model.
Q: Why do AI-generated applications increase the risk of security misconfiguration?
A: Because models optimise for working output, they often emit permissive settings that satisfy the prompt but weaken the environment.
Q: What do security teams get wrong about application-layer cloud protection?
A: Many teams assume broader platform coverage automatically means better protection.
Practitioner guidance
- Test authorisation at the object and action level Build application tests that validate who can access, edit, approve, and delete specific records or workflows.
- Reduce runtime privilege in cloud deployments Review container, serverless, and service-account permissions for each application release.
- Gate AI-assisted code with policy controls Require provenance, review, and security checks for AI-generated code, especially where it touches authentication, validation, or access control logic.
What's in the full article
Cycode's full article covers the operational detail this post intentionally leaves for the source:
- Per-vulnerability breakdowns across broken access control, misconfiguration, supply chain compromise, cryptographic failures, and injection threats.
- Specific examples of how AI-generated code introduces exploitable patterns into application logic and validation paths.
- Practical guidance on prioritising application security resources across SDLC stages and vulnerability classes.
- Cycode's own product and workflow context for teams that want implementation detail beyond the risk analysis.
👉 Read Cycode’s analysis of application security vulnerabilities to watch in 2026 →
Broken access control and AI code risk: what teams need now?
Explore further
20/08/2026 6:31 pm
Broken access control is now an identity problem, not just an application bug. When applications do not enforce object-level and action-level authorisation correctly, the result is effectively unauthorised identity use inside the business workflow. That is why IAM, IGA, and AppSec can no longer operate as separate control domains. Practitioners should map access-control findings to the permissions that actually govern business actions, not just login events.
A question worth separating out:
Q: What should organisations do when application release cycles outpace security review?
A: They should slow down the trust given to new code, not necessarily the release train. That means gating AI-assisted and third-party code with policy checks, treating build pipelines as protected assets, and requiring entitlement review when a release changes who or what can act. The goal is to stop new access paths before they become production truth.
👉 Read our full editorial: Application security vulnerabilities in 2026 are widening access risk
