Notifications
Clear all
Topic starter
02/08/2026 12:25 pm
TL;DR: AI-assisted development is accelerating code output, but IDC and BaxBench findings cited by Checkmarx show limited scrutiny, with up to 70% of AI-generated code evaluating as insecure or flawed against secure coding baselines. The governance problem is that code generation and code review are being conflated, creating a separation-of-duties failure inside the software delivery pipeline.
NHIMG editorial — based on content published by Checkmarx: The person who writes the code shouldn’t be the one who signs off on its security
By the numbers:
- 70% of AI-generated code was found to be, to be insecure or flawed when evaluated using secure coding baselines.
- Developers using GenAI tools achieve a 35% productivity boost, often matching the output of 3–5 engineers.
Questions worth separating out
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why do AI coding assistants increase AppSec governance risk?
A: They increase risk because they optimise for speed and plausible output, not for context-aware security validation.
Q: What do security teams get wrong about review loops in AI-assisted development?
A: Teams often assume a review loop automatically means control is preserved.
Practitioner guidance
- Separate code generation from code approval Require a human approver who is not the author of the change, and make that approval explicit in the pull request workflow.
- Move AppSec enforcement into the IDE and pull request path Block high-risk code paths, vulnerable dependencies, and secret patterns before merge, not after deployment.
- Treat secrets and package risk as pipeline policy events Apply enforced rules for credential exposure, dependency approval, and licence compliance so AI-generated suggestions cannot bypass organisational standards.
What's in the full article
Checkmarx's full analysis covers the operational detail this post intentionally leaves for the source:
- Benchmark methodology behind the AI-generated code quality comparisons and remediation cost assumptions
- Product workflow details for pre-commit detection, policy gating, and audit trail generation
- Examples of how security fixes are proposed without breaking surrounding application logic
- Performance and risk metrics used to compare remediation outcomes across development scenarios
👉 Read Checkmarx's analysis of vibe coding, AppSec review gaps, and GenAI risk →
Vibe coding and AppSec review gaps: are your controls keeping up?
Explore further
02/08/2026 1:24 pm
Vibe coding is creating a separation-of-duties problem inside software delivery. When the same workflow can both generate and accelerate acceptance of code, human review becomes less reliable as a control boundary. That is a governance failure, not just a tooling gap. AppSec programmes should treat authoring and approval as distinct control functions, with policy gates between them.
A question worth separating out:
Q: How should organisations govern AI-assisted development in secure pipelines?
A: They should treat AI-assisted coding as a controlled workflow with explicit owners, enforced policy checks, and measurable outcomes. Put controls in the IDE, pull request, and CI/CD stages, then monitor whether remediation time, flaw density, and exception rates improve. Governance should focus on who approved the change and what policy prevented unsafe code from merging.
👉 Read our full editorial: Vibe coding is exposing an AppSec review gap in AI-assisted code
