Mon, 9th Nov 2026 (Today)
PIETER DANHIEUXCEO and Co-FounderSecure Code Warrior
The debate over whether generative AI should be used to develop software is effectively over. After two years of rapid adoption, AI-generated code has become an established part of enterprise software development.
The more pressing question for chief information security officers (CISOs) is how to maintain security and regulatory compliance as generative AI, and increasingly autonomous AI agents, take on a greater share of software development.
As organisations seek to capitalise on the <a href="https://bitcomme.com/10-hobbies-experts-say-can-boost-productivity/” title=”10 Hobbies Experts Say Can Boost Productivity”>productivity gains offered by generative AI, while also embracing the capabilities of Model Context Protocol (MCP), a four-point framework is emerging to help manage the associated risks.
The framework provides enterprises with a practical foundation for embedding security and compliance into software development, both today and as AI-generated code becomes more prevalent.
AI-powered coding tools can deliver substantial productivity benefits, however their impact on software quality and security depends heavily on how they are deployed and governed.
Developers equipped with strong security skills and operating within a clearly defined framework can harness AI to produce more accurate, secure code from the outset. This potentially delivers significant improvements in development efficiency and software quality.
Conversely, organisations that adopt AI coding tools without appropriate safeguards risk introducing vulnerabilities at an unprecedented scale. Rather than accelerating secure software delivery, they could find themselves facing a growing backlog of security flaws, rising remediation costs, and greater compliance exposure.
For CISOs, the priority is therefore shifting from controlling the adoption of AI coding tools to establishing the architectural principles, governance controls, and development practices needed to use them securely.
The risks of AI coding are on the rise
Ever since GenAI became a readily accessible tool for an array of business and personal tasks, with the release of ChatGPT in November 2022, quickly followed by other large language models (LLMs), its suitability for code generation has been a hot topic.
Almost immediately, developers began working with GenAI to some degree, and both sides of AI’s double-edged sword soon became apparent.
The productivity boost was immediately clear while some early studies determined that AI-generated code was as secure (or even more secure) than code generated by humans.
However, that still left plenty of room for error as human developers are far from perfect either. The real risk was how often and how quickly those errors could propagate into production software.
Achieving secure AI-generated code
Having a framework for secure use of AI coding tools isn’t a final destination, but rather a starting point that organisations can adopt now. Gartner offers a four-phase roadmap to achieve this:
- Phase 1:Address your cybersecurity debt.
- Phase 2:Strategically expand existing cybersecurity controls.
- Phase 3:Extend controls to AI-specific requirements.
- Phase 4: Develop a forward-looking plan to secure the future use of AI.
Developers need clear guidance on using AI coding tools. Having a list of trusted LLMs, together with a list of appropriate tools, is a good starting point. These tools should focus on foundational security best practices and the observability and traceability of developer security skills.
Organisations must focus on the security efficacy of the AI tools they use, ensuring that they are built to meet the demands of a secure environment.
For example, developers need to be able to leverage AI tools for developer-led threat modelling, not just code output. The right AI tools, used the right way, can enhance security while also preventing many errors from slipping into the pipeline.
Good governance is also vital as a lack of visibility and governance can breed ‘shadow AI’ and the spread of insecure code. A tool that provides deep observability into the AI tools in use and MCPs being utilised can enable organisations to effectively manage AI adoption.
Upskilling developersre use of AI early in the software development lifecycle (SDLC), allowing organisations to innovate faster and more securely
Meanwhile, CISOs can empower their developers through educational programs that provide hands-on, real-world upskilling in secure coding. They can also measure their progress in acquiring new skills and observing their commits to see how well they apply those skills on a daily basis, including their ability to check the work of AI tools.
Using benchmarks to establish the required skills and measure educational progress helps organisations effectively manage their use of AI in software development.
AI coding tools such as GitHub, Copilot, and Cursor are rapidly becoming embedded in software development, driving productivity gains and accelerating innovation across virtually every industry.
However, their widespread adoption also reinforces the need to make security a fundamental part of the software development lifecycle, rather than an afterthought.
For organisations seeking to maximise the benefits of AI-assisted development without compromising security or compliance, adopting a four-point framework provides a practical starting point.
ConnectChatGPT
Key takeawaysExplain why it mattersCreate action planFuture watch
Claude
Key takeawaysExplain why it mattersCreate action planFuture watch
Perplexity
Key takeawaysExplain why it mattersCreate action planFuture watch
Grok
Key takeawaysExplain why it mattersCreate action planFuture watchShareShareAdd us as a preferred source on Google
Image: Pieter Danhieux
Related stories
Google warns AI is reshaping cyber attacks & defencesSnapLogic launches SnapCode for Claude Code integrationGartner flags 10 tech trends for 2027 as AI governanceTokenmaxxing won’t fly in APAC. How to shrink AI spend without limiting securityAI security incidents expose new criminal tradeoffs
Top stories
Fortinet lifts full-year outlook after strong third quarterAustralian MSPs face rising demand for AI security adviceZepto says NPP drives A2A growth as payroll shiftsOpenAI widens AI access across four Australian universitiesPeak Insight appoints new hires after revenue surge
