The landscape of modern software development is undergoing a tectonic shift. With artificial intelligence (AI) now woven into the fabric of daily coding tasks, development velocity has reached unprecedented levels. However, this acceleration brings with it a critical, often overlooked challenge: the security of the software itself. As development teams race to leverage AI for efficiency, the traditional pillars of cybersecurity are being tested like never before.
According to Chaim Mazal, Chief Information Security Officer (CISO) at GitLab, the industry is at a crossroads. While AI presents a "prime opportunity" for security teams to keep pace with hyper-accelerated release cycles, it requires a fundamental departure from legacy security practices. The era of the "manual auditor" is ending, replaced by the necessity of the "security engineer."
The Rapid Adoption of AI in Development
The data suggests that the transition to AI-assisted coding is no longer an experimental phase; it is the new standard. According to the Stack Overflow 2025 Developer Survey, a staggering 84% of developers have adopted AI-driven tools. This widespread integration is driving significant gains in productivity, streamlining development lifecycles, and allowing companies to push code to production faster than at any point in history.
However, the sheer volume of AI-generated code is outpacing the ability of security organizations to govern it. Recent analysis by GitLab highlights a concerning trend: eight-in-ten organizations are currently deploying AI tools at a speed that vastly outstrips their ability to implement adequate policy frameworks. This "governance gap" is not merely theoretical—it has tangible, risky consequences. Research from Tricentis indicates that approximately 60% of organizations have shipped code that has not undergone adequate testing.
For enterprise security teams, this creates a "confluence of challenges." They are tasked with maintaining rigorous security standards while simultaneously enabling the business to maintain its competitive edge through rapid delivery. The result is a high-pressure environment where the margin for error is shrinking, and the potential for blind spots in the software supply chain is growing.
Chronology: From Assistance to Autonomy
To understand the current crisis, one must look at the rapid evolution of development tools over the last few years.
- Phase 1: The Assistance Era (2022–2023): AI tools primarily served as autocomplete engines or "co-pilots," providing suggestions for boilerplate code or simple syntax corrections. Security teams viewed these as low-risk additions to the IDE (Integrated Development Environment).
- Phase 2: The Proliferation Era (2024): Organizations began integrating AI more deeply, using it for refactoring, unit test generation, and documentation. The volume of AI-generated code exploded, making manual code review an impossibility.
- Phase 3: The Agentic Era (2025–Present): We have entered the age of "agentic AI," where autonomous systems can manage entire workflows—writing, testing, and even deploying code. This shift from "co-pilot" to "autonomous agent" is where the current security risks, such as hallucinated vulnerabilities or insecure patterns, are most acute.
As these agents take over more of the CI/CD (Continuous Integration/Continuous Deployment) pipeline, the traditional "gatekeeper" model of security—where a human manually reviews code before it hits production—has effectively collapsed.
Supporting Data: The Cost of Speed
The industry’s reliance on AI is fueled by the desire to reduce time-to-market. Yet, the cost of speed is becoming increasingly evident in financial and security metrics.
When code is generated by an AI, it is only as good as the training data and the guardrails provided. If an AI suggests a vulnerable library or an insecure API call, a developer under pressure to hit a deadline may accept the suggestion without scrutiny. The Tricentis report on untested code underscores that this is a widespread phenomenon. When enterprises ship large volumes of untested, AI-generated code, they are essentially introducing latent vulnerabilities that can lead to:
- Increased Technical Debt: Remediation of vulnerabilities discovered post-deployment is significantly more expensive than fixing them in the development phase.
- Regulatory Non-compliance: With new AI regulations emerging globally, shipping unverified code can lead to substantial fines and legal exposure.
- Reputational Damage: A single security breach resulting from an AI-hallucinated bug can erode years of customer trust.
Official Perspective: The "Engineering-First" Mandate
Chaim Mazal, representing the frontline of this struggle, argues that the only way forward is for security teams to adopt an "engineering-first" approach. This model suggests that security should no longer be a consultative function that sits outside the development process, but rather a core component of the engineering team itself.
"Businesses have decided that in order to be successful in this next wave of the journey, AI has to be leveraged and teams have to go full bore," Mazal stated in an interview with ITPro. "I think in tandem and parallel, security teams have been working on figuring out how they can build appropriate solutions to be able to enable their organizations to do that."
For Mazal, the solution lies in the following transformations:
- Security as a Contributor: Security professionals must be capable of writing code, building automated security tools, and contributing directly to the CI/CD pipeline.
- Automated Guardrails: Instead of manual reviews, security must define "secure paths." These are pre-approved, automated workflows that ensure any code produced by an AI or a developer is automatically subjected to vulnerability scanning, compliance checks, and policy enforcement before it ever reaches a repository.
- Active Participation: Security teams must move away from being purely "consultative" and start acting as architects of the development environment.
"Being able to move fast, iterate fast, and not just be consultative in nature, and being able to really roll up our sleeves and work alongside the rest of the teams to build that secure path and the secure guardrails is something I think most modern security teams don’t have the luxury of foregoing," Mazal added.
Implications: The Human-in-the-Loop Dilemma
The ultimate goal for many organizations is a "lights-out" software factory, where the majority of code is auto-generated, auto-reviewed, and auto-deployed. While this represents the pinnacle of efficiency, it creates a philosophical and practical dilemma: where does the human fit in?
Mazal suggests that the long-term vision is to minimize human involvement to only those areas where it is "absolutely necessary, based on the risk to the organization." This is the rise of the "dark testing factory," where autonomous systems stress-test other autonomous systems. However, the industry is still in the experimental phase.
The implications are clear:
- The Skill Gap: Security professionals will need to upskill, transitioning from traditional security auditing to roles that resemble DevOps and Software Engineering.
- The Governance of Agents: Organizations must develop frameworks for "Agent Governance." Just as we have identity and access management (IAM) for humans, we will need "Agent Management" systems to oversee what an AI agent is permitted to do within the source code.
- Continuous Adjustment: There is no "set and forget" solution. Because AI models are constantly updating, the security guardrails surrounding them must be similarly dynamic.
Conclusion: Toward a Secure AI Future
The rapid adoption of AI in software development is an irreversible trend. The organizations that succeed will not be those that attempt to block AI to maintain old-world security, but those that successfully integrate security into the very fabric of their AI-powered pipelines.
By shifting toward an engineering-first culture, embracing automation, and establishing clear guardrails, security teams can transform from a potential bottleneck into a powerful enabler of business velocity. As Chaim Mazal notes, the industry is making "big leaps and bounds" in short periods of time. The challenge for every CISO today is to ensure that while the business moves fast, it does not break the foundational security that keeps the enterprise safe.
The future of software is autonomous, but the responsibility for its integrity remains firmly in the hands of the organizations that build it. The message is clear: iterate fast, but build the guardrails even faster.
About the Author
