Notifications
Clear all
Topic starter
19/08/2026 3:33 pm
TL;DR: Inference costs are falling, but the routing problem, not model price, determines where deep analysis earns its cost, according to Cycode. The practical lesson is that AppSec teams need deterministic controls as the always-on layer and selective AI analysis for high-blast-radius changes.
NHIMG editorial — based on content published by Cycode: The Token Dilemma: Why AI Security Scales on Architecture, Not Model Pricing
By the numbers:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
Questions worth separating out
Q: How should security teams decide where to use deep AI analysis in code review?
A: Use deep AI analysis only where the marginal value exceeds its cost.
Q: When does AI scanning create more risk than it reduces?
A: AI scanning becomes risky when teams rely on it as the primary control and let the routing layer go ungoverned.
Q: What do organisations get wrong about AI security coverage?
A: They often treat AI as a single category and then count tool coverage as governance.
Practitioner guidance
- Define routing criteria for deep AI scans Base escalation on signals such as ownership changes, deployment impact, dependency churn, and sensitive data paths.
- Keep deterministic controls as the universal first pass Run SAST, SCA, secrets detection, and IaC checks on every commit or PR so that AI is used to enrich decisions rather than cover baseline detection gaps.
- Audit AI-assisted development access paths Map where AI coding agents obtain context, what tool permissions they inherit, and which actions they can trigger through MCP or similar integrations.
What's in the full article
Cycode's full article covers the operational detail this post intentionally leaves for the source:
- The practical decision logic used to route expensive AI analysis toward high-value code changes and away from routine diffs.
- How deterministic controls such as SAST, SCA, secrets detection, and policy checks act as the always-on first layer.
- The specific signals the platform uses, including change graph, ownership data, exploitability, and deployment topology.
- Why AI scan volume alone is a misleading measure of security coverage at enterprise scale.
👉 Read Cycode's analysis of why AI security scales on architecture, not model pricing →
AI security routing is the real constraint for enterprise AppSec?
Explore further
19/08/2026 4:15 pm
AI security routing has become a governance problem, not just a cost problem. When organisations cannot afford deep analysis everywhere, they are forced to choose what gets examined, by whom, and at what depth. That choice determines whether the security programme sees meaningful risk or just generates expensive noise. Practitioners should treat routing as a policy decision, not a procurement optimisation.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How should identity teams think about AI coding agents in secure development workflows?
A: Treat AI coding agents as governed software entities, not passive features. If they can access repositories, context, or tools, then their permissions, session boundaries, and approval paths need explicit control. The key question is not whether the model is smart enough, but whether its access is scoped tightly enough to the task.
👉 Read our full editorial: AI security scales on architecture, not model pricing
