Quick Summary
As AI integrates into development workflows, application security models are rapidly evolving. James Wickett, CEO of DryRun Security, highlights the challenges of legacy security tools that fail to meet developers’ needs. The introduction of large language models (LLMs) alters the risk landscape, creating a need for clearer definitions of AI risks and best practices to ensure security without hindering development speed.
The Securityish Brief
James Wickett, CEO of DryRun Security, discusses the significant changes in application security models due to the integration of AI technologies. As organizations adopt AI into their development processes, traditional security tools often fall short, leaving developers overwhelmed and security teams struggling to prioritize effectively. Wickett notes that the shift left movement aimed to improve security early in the development cycle but has not fully addressed the needs of modern development teams.
When large language models (LLMs) are deployed, they introduce a probabilistic element that can access new data and behave unpredictably. This shift creates a mismatch between the capabilities of deterministic security tools and the dynamic nature of AI applications, leading to high usage but low trust among developers. They may rely on AI for efficiency while fearing potential security regressions.
Teams are now seeking clearer definitions of AI-related risks, reference architectures, and best-practice controls to address issues like prompt injection and excessive agency. The objective is to evolve security practices in tandem with AI advancements, allowing teams to maintain rapid development cycles without compromising security.
Understanding AI Risks in Development
The integration of AI into development workflows presents unique challenges that require a reevaluation of security practices. Developers are increasingly using AI tools to enhance productivity, but this reliance raises concerns about the stability and security of applications. Organizations must adapt their security frameworks to account for the unpredictable nature of AI systems.
Wickett emphasizes the need for organizations to establish clear guidelines and controls around AI usage. This includes developing reference architectures that outline best practices for integrating AI into existing workflows while ensuring security measures are in place to mitigate risks associated with AI technologies.
As AI continues to evolve, organizations must remain vigilant and proactive in addressing the security implications of these technologies. By fostering a culture of security awareness and adapting to the changing landscape, teams can leverage AI effectively while minimizing potential risks.
Key Takeaways
- Evaluate your current security tools to ensure they align with modern development practices involving AI.
- Establish clear guidelines for the use of AI technologies within your development teams.
- Implement reference architectures that incorporate best practices for AI security.
- Train your teams on the specific risks associated with AI applications, such as prompt injection.
- Encourage open communication between development and security teams to address concerns about AI stability and security.
Key Terms & Concepts
- Shift Left Movement: In this article, the shift left movement refers to the practice of integrating security measures earlier in the software development lifecycle.
- Large Language Models (LLMs): In this article, LLMs are advanced AI systems that can generate human-like text and perform tasks based on probabilistic reasoning.
Read the original article here: https://securityboulevard.com/2026/01/why-ai-changes-the-risk-model-for-application-security/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
