Checkmarx's Future of AppSec report finds only about 9% of organizations fix 90% of their vulnerabilities.
Frank Emery says the organization releasing the product owns the risk, not individual teams.
Emery recommends layered Swiss cheese checks from code generation to runtime, tracking time to discovery, fidelity and remediation.
AI writes code faster than security teams can verify it
AI writes code faster than teams can verify it, and the risk compounds with every commit, since one missed critical vulnerability is enough for a breach. Only about 9% of organizations fix 90% of their vulnerabilities. Checkmarx's answer is layered validation running from code generation to runtime, with human review reserved for architecture and progress measured by exposure time rather than output.
Takeaways
AI takes routine coding, architecture matters more. AI has taken over routine implementation, while architecture and planning become the valuable skills. Frank Emery warns that developers who never learn the basic day-to-day tasks never develop those higher skills .
Faster commits compound unverified security risk. AI-assisted developers commit code three to four times faster than peers. A control catching 20% of vulnerabilities at each commit leaves a gap that compounds, and one missed critical vulnerability is enough to be hacked .
Few organizations fix most of their vulnerabilities. Checkmarx's Future of AppSec report found only about 9% of organizations fix 90% of their vulnerabilities. Guardrails inside coding assistants do not scan everything, so the unscanned remainder still carries breach risk .
The shipping organization owns the security risk. The buck stops with the company putting the product out, because an end user blames the organization rather than an individual team. Developers validate their own code and team leaders enforce that discipline .
Understand generated code before opening a pull request. Too many people fire off a prompt and immediately execute a pull request. Emery says vulnerabilities are often logical rather than scripting issues, tied to what the code does in context, so working code is not secure code .
Agent independence should track AI maturity. One company lets its AI define its own requirements and push code straight to production. Emery would not yet let AI define business architecture, though low-risk changes such as colour tweaks can be automated .
Measure exposure windows, not code output. Time to discovery and time to remediate, plus the volume and fidelity of what is found, are the measures that matter. Fidelity is far better than eighteen months earlier, and fixing has sped up alongside exploitation .
The Swiss cheese defense stack
Validate at generation. Checkmarx's DevAssist checks that code is being generated correctly, and security can be built into prompts so a model like Claude produces a secure prompt instead of an insecure one .
Scan statically and across the supply chain as code is committed, then run application testing as it moves into applications .
Test at runtime once the code is deployed, keeping checks as early in the lifecycle as possible .
Replace the stage gate with continuous validation, plus AI-driven analysis daily, weekly or monthly to catch what the continuous scanning missed .
Tap a name to go there · tap a line to see why they are linked
