Securing AI Generated Code Without Losing Speed With Checkmarx
Show notes
If AI can help anyone create an application, who checks whether the result is secure enough to put into production?
In this episode of Tech Talks Daily, I speak with Frank Emery, VP of Product Management at Checkmarx, about the skills and security practices needed as AI becomes part of software development. We begin with developers entering the workforce alongside coding assistants and the experience they still need to build.
Frank argues that architecture, review and an understanding of what code actually does become increasingly valuable when generating that code takes less time.
We discuss what happens when output grows faster than teams can review it and vulnerabilities accumulate across repeated changes. I ask who should own the risk when AI-generated code passes through several tools and teams.
Frank places responsibility with the organization releasing the product, supported by developers who validate their work, team leaders who maintain that discipline and application security teams that establish standards. He also explains why a feature behaving as expected does not establish that it is secure.
The conversation considers how much independence coding agents should have. Frank describes the importance of existing controls, the difference between routine changes and architectural decisions, and the need to separate code generation from security testing.
We then discuss layered checks across the development process, with quick feedback during generation, further checks around pull requests and deeper testing as an application develops. The aim is to make each check appropriate to the stage rather than applying every test at the earliest possible moment.
We close by considering continuous validation and the measures that can show whether a team is reducing risk. Discovery time, detection quality, remediation time and exposure all offer a more useful perspective than counting how much code has been produced.
For leaders adopting AI development tools, the conversation raises practical questions about speed, responsibility and the judgment needed to release dependable software. How is your organization reviewing AI-generated code, and what would help your teams build with greater confidence? Please share your thoughts with me.