Notifications
Clear all
Topic starter
02/08/2026 11:48 am
TL;DR: RSAC 2026 exposed a recurring theme: GenAI is compressing years of latent application security debt into months, while organisations with mature CI/CD and documented systems are coping better, according to Veracode. The real risk is not that AI creates every flaw, but that it makes hidden engineering and governance gaps visible faster than teams can remediate them.
NHIMG editorial — based on content published by Veracode: What RSAC 2026 Actually Told Us About Your Security Debt
By the numbers:
Questions worth separating out
Q: How should security teams control AI-assisted development when release speed keeps increasing?
A: Security teams should place policy and testing controls earlier in the delivery flow, then focus remediation on the systems where code velocity, privileged automation, and external dependencies intersect.
Q: Why does GenAI make existing security debt more dangerous?
A: GenAI makes security debt more dangerous because it shortens the time between creating, changing, and releasing code.
Q: What breaks when organisations rely on undocumented systems during AI-assisted delivery?
A: Undocumented systems break governance first.
Practitioner guidance
- Map security debt to delivery velocity Identify the applications and pipelines where GenAI is accelerating release cycles faster than review, testing, or approval processes can follow.
- Inventory undocumented dependencies and runtime access paths Create a current view of service accounts, secrets, CI/CD permissions, and third-party dependencies for the systems most likely to be touched by AI-assisted development.
- Treat build-time identity as a governed control plane Review the identities used by pipelines, testing tools, and deployment automation.
What's in the full article
Veracode's full blog post covers the operational detail this post intentionally leaves for the source:
- How the 2026 State of Software Security report links AI-generated code to specific remediation pressure points.
- Chris Wysopal's observations on which organisations are coping better because of mature CI/CD and documented systems.
- The panel discussion context behind the "vibe coding" concern and how practitioners interpreted it.
- The award and market signal around shifting application security focus from counts to business risk.
👉 Read Veracode's analysis of RSAC 2026 and the security debt impact of GenAI →
GenAI in the SDLC: what RSAC 2026 said about security debt?
Explore further
02/08/2026 12:58 pm
Security debt is now a governance issue, not just an engineering backlog. GenAI is not the first technology to expose weak software practices, but it is unusually good at surfacing them faster than remediation cycles can absorb. That shifts the conversation from code quality to organisational control of change, dependencies, and access paths. For practitioners, the implication is that security governance must track delivery velocity as a risk factor.
A question worth separating out:
Q: Which controls matter most for AI-generated software security?
A: The most effective controls are IDE-integrated SAST, software composition analysis, package allowlisting, and DAST for deployed behaviour. Together they cover code quality, dependency trust, and runtime exposure. Organisations should also add policy-as-code so AI-assisted workflows are governed continuously rather than by after-the-fact review.
👉 Read our full editorial: RSAC 2026 showed how GenAI is exposing latent security debt
