AI-generated code has become an integral part of everyday software development, enabling developers to prototype, refactor, troubleshoot, and move from idea to implementation with unprecedented speed and efficiency.
However, this increased productivity comes with a significant caveat: security leaders must now confront the challenge of governing the risks created by AI-generated code at the same accelerated pace. The root of this challenge lies in scale, as AI-driven code generation outpaces the capacity of many application security programs, which still rely on controls designed for slower development models.
Risk Velocity: A New Metric for Security Leaders
The traditional metric for measuring application security has been discovery, where teams count vulnerabilities, categorize severity, report trends, and track improvements. While these questions remain relevant, AI introduces a more pressing metric: risk velocity. Security leaders must now understand how quickly their organization creates new software risks and how rapidly they can mitigate or eliminate them.
The Economics of Security Debt
AI alters the economics of security debt, as development teams producing significantly more code without a corresponding increase in security capacity create more issues than they can reasonably review or fix. Even when AI-generated code is comparable to human-written code on a per-line basis, the total risk rises due to the higher volume of change. This leads to a growing backlog, persistent vulnerabilities, and eventually, security debt constraining the business.
The failure modes associated with AI-generated code are familiar, including the reproduction of insecure patterns found in training data, such as weak input validation, unsafe authentication flows, and vulnerable dependency choices. AI coding tools can also miss the context that determines whether code is secure in a specific environment, including authorization models, tenant boundaries, and data sensitivity.
The Human Factor: Misplaced Confidence
Under deadline pressure, developers may accept code that works without fully understanding how it does so, resulting in misplaced confidence. Code compiles, tests pass, features ship, and hidden risks enter the system. Over time, organizations may lose sight of the security concerns that naturally arose during manual development.
Supply-Chain Risk: A Bigger Concern
The software supply chain introduces another layer of risk, as modern applications are assembled from open-source components, frameworks, plugins, containers, APIs, and cloud services. AI coding tools can recommend outdated packages, vulnerable libraries, or nonexistent dependencies, as highlighted by Veracode's 2025 GenAI Code Security report, which found that AI coding tools produce insecure code nearly half of the time.
Security teams need a control model built for the reality of AI-driven development. The industry's 'Shift Left' approach needs an enforcement layer, as security cannot remain a checkpoint near the end of the process. Instead, it must become a continuous control system integrated into the software creation, testing, approval, and deployment process.
Secure-by-Design: The Way Forward
Secure-by-design requires an engineering environment where unsafe choices are harder to make and easier to catch. Approved frameworks, secure defaults, reference architectures, dependency controls, automated testing, and policy enforcement should be embedded directly into developer workflows and CI/CD pipelines. Remediation must also move closer to the point of creation, with inline fixes proposed, validated, and governed as part of the normal development process.
CISOs should focus on governance, not just approving AI coding tools. Governance involves tracking where AI-generated code enters the environment, documenting policies and tests applied, recording issues found and fixed, and maintaining proof of these decisions. This documentation becomes critical as AI-assisted development becomes standard.
Leaders should treat AI-generated code as untrusted until proven otherwise, requiring automated testing before release, enforcing dependency controls, prioritizing remediation based on exploitability and business impact, and measuring success by the rate at which critical risk is reduced. Boards and organizational policymakers should ask whether organizations can demonstrate that AI-assisted software is governed before it is deployed.
Source: CyberScoop