Topic starter
02/08/2026 11:48 am
TL;DR: 81% of organisations knowingly shipped vulnerable code and 98% experienced a breach tied to vulnerable code in the last year, according to Checkmarx, as AI-assisted development overwhelms manual triage and remediation. The governance shift is to move security decisions into pull requests, where evidence, accountability, and reviewable AI-assisted fixes can scale with delivery.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Stop Manual Triaging, Start Agentic Fixing”.
Key questions
Q: What breaks when appsec triage is handled manually at scale?
A: Manual triage breaks consistency first, then throughput.
Q: Why does insecure code become a governance issue when delivery accelerates?
A: Because the organisation can no longer prove that it made timely, consistent, and documented risk decisions.
Q: What are the signs that appsec decisioning is failing?
A: Look for long backlogs, repeated debate over the same class of issue, inconsistent risk acceptance, and teams treating identical findings differently.
Practitioner guidance
- Standardise triage outcomes Define a small set of decision outcomes such as fix, accept, defer, or false positive, and require the same rationale format across teams so similar findings are handled consistently.
- Move remediation into pull requests Attach security review, approval, and fix verification to the pull request so the evidence chain stays with the code change rather than a separate ticketing system.
- Control AI-assisted fixes Allow AI to draft remediation suggestions, but require human approval before merge and preserve the review trail for audit and exception handling.
Bottom line: Manual appsec triage becomes a governance liability when decision quality cannot keep pace with code velocity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:58 pm
Manual appsec triage is now a governance problem, not just an efficiency problem. Once the number of findings exceeds the organisation's ability to make consistent decisions, the issue becomes auditability and control quality. That is true whether the source is developer velocity, dependency churn, or AI-assisted code generation. The practitioner conclusion is simple: if decisions cannot be repeated, explained, and evidenced, they are not governed.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should security teams do when AI remediation is offered in pull requests and dashboards?
A: Security teams should treat pull-request and dashboard workflows as delivery channels, not proof of correctness. They should define which rule categories are eligible, monitor the quality of suggested fixes, and route anything uncertain back to normal review. That keeps the process fast while preserving accountability for secure code decisions across AppSec and development teams.
👉 Read our full editorial: Manual appsec triage is becoming a governance liability