Quick Summary
Scott Gerlach, co-founder and CSO of StackHawk, highlights the widening gap in application security as developers often remain unaware of risks in their code. With the rise of continuous integration and deployment (CI/CD) practices, traditional security testing methods have failed to scale. The increasing use of AI to generate code has compounded these issues, leading to vulnerabilities that are difficult to detect, particularly in business logic and APIs.
The Securityish Brief
Scott Gerlach, the co-founder and CSO of StackHawk, emphasizes the challenges in application security as development speeds increase due to modern CI/CD practices. Traditional security testing methods, which often rely on periodic checks, are no longer effective in identifying risks associated with rapidly deployed code. As developers utilize AI tools to generate code at an unprecedented pace, the volume of potential vulnerabilities has surged.
Gerlach points out that many of the most significant risks today arise not from obvious coding errors but from flaws in business logic, especially within APIs. Issues such as authorization failures and cross-tenant data exposure can be particularly challenging to detect without thorough behavioral testing. These vulnerabilities often go unnoticed through static analysis, surfacing only when applications are tested in real-world scenarios.
The challenge for security teams lies in prioritizing their efforts. With limited resources, it is impractical to test every piece of code. Organizations should focus on areas where changes are frequent, where sensitive data is processed, or where APIs serve as essential connections between services. This targeted approach is crucial for effective risk management.
In this evolving landscape, Gerlach advocates for a shift in the goal of application security from merely preventing risks to enabling secure development. By aligning security insights with the rapid pace of development, teams can support faster releases without compromising trust or resilience.
Understanding the Current Cybersecurity Landscape
The increasing reliance on AI-generated code highlights a critical gap in application security practices. As organizations adopt faster development cycles, they must also evolve their security measures to keep pace. This includes recognizing that traditional testing methods may not suffice in identifying complex vulnerabilities.
For everyday users and organizations, this means being vigilant about the security of applications they use or develop. Understanding the potential risks associated with AI-generated code and ensuring robust testing practices can help mitigate these vulnerabilities.
Key Takeaways
- Review your application security testing processes to ensure they align with modern development practices.
- Focus on behavioral testing for APIs to detect vulnerabilities that traditional methods may miss.
- Prioritize security efforts on areas handling sensitive data or undergoing frequent changes.
- Encourage collaboration between development and security teams to enhance risk awareness.
- Stay informed about the latest trends in AI and application security to adapt your strategies accordingly.
Key Terms & Concepts
- CI/CD: In this article, CI/CD refers to continuous integration and continuous deployment practices that allow for rapid software development and release.
- APIs: APIs, or application programming interfaces, are sets of rules that allow different software applications to communicate with each other.
- Business Logic Flaws: Business logic flaws are vulnerabilities that arise from incorrect implementation of the rules that govern how an application operates.
Read the original article here: https://securityboulevard.com/2025/12/why-appsec-cant-keep-up-with-ai-generated-code/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
