Traditional AppSec approaches — “scan, test, fix” — no longer fit the AI era. Development is faster, pipelines are automated, and now, AI is writing the majority of our code.
Over the past year, I’ve spoken with hundreds of engineering, security, and platform teams across industries. One theme is universal:
AI is transforming how we build software and it’s reshaping what security must look like.
95% of enterprise code will be AI-generated by 2030 by Kevin Scott, Microsoft CTO (Future of Work keynote) https://www.techspot.com/news/107411-microsoft-cto-predicts-ai-generate-95-percent-code.html
That’s not a typo. In just a few years, almost everything running in production may be written by a model, not a human. And yet…
“At least 48% of AI-generated code contains security vulnerabilities” https://www.netcorpsoftwaredevelopment.com/blog/ai-generated-code-statistics
And the gap is widening. We’re building with AI… But we’re not securing AI.
Some people are excited. Some are nervous. Most are a little of both. And honestly? That’s normal. We’ve never faced a shift this big, this fast. Let’s unpack why. When security doesn’t evolve with speed, we get “AI-speed delivery with legacy-speed security” and that mismatch is where risk thrives.
“We used to worry about interns committing bad code. Now we worry that the AI intern wrote the bad code and the real intern just clicked ‘merge.’”
It’s like racing a self-driving car with a map from 2005. The speed doesn’t match the controls.
Developers today are working with AI copilots that generate functions, tests, docs, and entire modules in minutes. Meanwhile, Security teams are still relying on:
- slow scans
- manual reviews
- ticket queues
- once-a-quarter threat model
AI is entering every stage of the SDLC from code generation to testing and deployment, introducing new attack surfaces:
- Prompt Injection & Context Leaks — where malicious inputs hijack AI behavior.
- Model Poisoning — attackers inject malicious data into training pipelines.
- AI Supply Chain Risks — tainted models or plug-ins from open repositories.
- Shadow AI — unsanctioned AI tools quietly integrated into workflows.
Modern DevSecOps: The Growing Pains
Let’s be honest, DevSecOps was already hard. AI just added rocket fuel. Here are the realities teams shared with me:
- Tools that took hours to run now block pipelines built for minutes.
- Teams drown in false positives and miss actual threats.
- Cloud, code, containers, AI models, agents ― all in different tools.
- There simply aren’t enough skilled people to keep up.
AI and Future
- Almost every application is backed by ML models and smart agentic services
- AI writes the majority of your software, tests it, refactors it, and deploys it
- Runtime security guards not only APIs but model behavior
- Security becomes behavioral governance instead of vulnerability chasing
New Tools for New Threats
To stay ahead, we need AI-native security capabilities, including:
- AI Security Posture Management (AISPM)
- Model Red Teaming & Risk Registries
- OWASP LLM Top 10 Testing
- Agent Guardrails & Runtime Monitoring
- Threat Modeling for AI Workflows
- Continuous Model Evaluation & Canary Prompts
Security must move from finding vulnerabilities to governing autonomous behavior.
AI isn’t just transforming technology — it’s redefining responsibility. DevSecOps must evolve into AI-DevSecOps where we secure not just code, but cognition itself.
Checkout my webinar with EC-Council - https://register.gotowebinar.com/register/5756563944936267095