AI reshapes security in software development
Artificial Intelligence is adding complexity to the software development lifecycle, but a Dark Reading roundtable identified collaboration, clearer identity visibility and lower testing expenses as pathways for CISOs to stay ahead of emerging risks.
When Renee Guttmann organized her first Open Worldwide Application Security Project (OWASP) gathering in New York during the early 2000s, many participants expressed doubt about the value of scanning web applications for flaws. The prevailing question was why anyone would care to examine code for vulnerabilities.
More than two decades later, Guttmann, who leads the security consultancy Cisohive, no longer has to convince anyone to listen. Initiatives like OWASP, which aim to boost software safety, are now regular fixtures in software development lifecycle (SDLC) discussions, helping developers embed secure practices across planning, testing, deployment and maintenance.
However, the ever‑growing attack surface and the rise of code written by non‑developers and AI tools make it harder to integrate security into the SDLC. Experts see opportunities in stronger teamwork, better insight into identities to pinpoint the most vulnerable vectors and technologies that cut patching costs, offering a roadmap to keep pace with rapid change.
The identity space is currently the most exposed attack vector. A recent Entro report shows that the average enterprise hosts 144 non‑human identities for every human identity. Applications, bots, AI agents and devices can interact with systems without human oversight, creating visibility gaps. Without proper guardrails this can lead to shared, weak or long‑lived credentials that attackers can exploit.
Renee Guttmann highlighted that organizations often lack a single source of truth for these identities, especially non‑human ones. She cited a Cloud Security Alliance study indicating that 68 percent of firms cannot differentiate between actions taken by AI agents and those taken by people. She recommends issuing short‑lived credentials for such identities and establishing logging processes that record the agent’s activity throughout its lifecycle.
Bobby Bauer, CISO of BlueFlag Security, emphasized that communication between security teams and the rest of the company remains a major opportunity. He pointed out that many internal stakeholders are unaware of the work security teams perform, such as silently strengthening legacy software to avoid slowing business processes.
Aftab Banth, former global enterprise head of security for TikTok, noted that source code and the broader SDLC environment represent a huge, historically underserved attack surface. BlueFlag, he explained, provides organizations with visibility into existing gaps and the ability to remediate them quickly.
Rusty Perry, former vice president of cybersecurity strategy at Western Union, warned that AI‑driven code development speeds will not slow down and that agents will play a large role. To move quickly and safely, teams must abandon the assumption that they always know who or what is acting inside their systems. He said, “Fix that first and then you can really go as fast as you want.”
Leadership boards and shareholders are now demanding more safeguards, not just policies but practical solutions for writing clean code. The current moment offers a chance to re‑engage with developers, including user developers outside IT, and build partnerships that embed security scanning deeper into the development environment. Acting now can turn momentum into lasting resilience.
Com informações de: Dark Reading