AI-generated code forces CISOs to measure risk velocity
The useful warning is not that AI writes bad code; it is that AppSec queues were never sized for machine-speed change.
TL;DR
A CyberScoop op-ed argues CISOs should treat AI-generated code as a high-risk input, with automated testing, dependency checks, fast remediation and policy gates before production. The piece says the relevant metric is “risk velocity,” citing familiar failure modes such as weak validation, hard-coded secrets, vulnerable dependencies and package hallucinations. The claim is governance, not magic: faster code creation makes old review bottlenecks worse.
This is an op-ed, so read it as an argument rather than a regulatory signal. The argument is still the right one: AI-generated code does not create a wholly new category of software risk. It accelerates the old one. If a development team can produce more code without adding comparable review, testing and remediation capacity, the vulnerability backlog grows even when the AI-written code is no worse than human-written code on a per-line basis.
That distinction matters for CISOs because most application security dashboards still reward discovery. Vulnerability counts, severity buckets and trend lines are useful, but they do not answer the operational question AI-assisted development puts on the table: how fast does the organization create new software risk, and how fast can it retire it? The op-ed calls that “risk velocity,” which is a better metric than another executive chart about adoption.
The failure modes listed are not exotic: weak input validation, unsafe authentication flows, insecure direct object references, hard-coded secrets, vulnerable dependencies and code that misses tenant boundaries or authorization context. The supply-chain version is uglier. The piece cites Veracode’s 2025 GenAI Code Security report for the finding that AI coding tools produce insecure code nearly half, 45%, of the time, and warns that recommended nonexistent or lookalike packages can become an attacker-controlled dependency if someone registers the name first.
For compliance teams, the practical move is not to ban the tools and pretend velocity will go back down. It is to make AI-generated code pass the same gates as any other high-risk input: automated security testing, dependency and package validation, secrets detection, remediation deadlines and production blocking when policy fails. “Shift left” without enforcement just moves the notification earlier. It does not make the defect go away.
Published ·Deep Fathom