Pieter Danhieux is the Co-Founder and Chairman/CEO of Secure Code Warrior.

getty

​Artificial intelligence (AI)-driven coding is no longer experimental; it’s embedded in the majority of daily workflows. In fact, more than seven out of 10 developers who have tried using AI now use AI coding tools every day.​

Yet, most organizations lack visibility into how these tools affect production code, creating governance blind spots as demand spikes and deadlines accelerate. According to the same survey linked above, security tops the list of problems on the minds of developer team members, with 57% saying they are either “extremely” or “very” concerned about the exposure of sensitive company or customer data. Similarly, 47% express concern about the introduction of new/subtle vulnerabilities, and 44% cite the introduction of severe vulnerabilities as a top worry.​

The issues here often arise from a number of questions that are left unanswered: Are our teams able to accurately spot and identify AI-developed code? If so, do they have the skills to effectively remediate AI-rooted problems? Is our organization implementing AI governance programs and guardrails? Are these initiatives actually making a positive impact? How are we measuring any of it?​

To address these critical inquiries, organizations must prioritize upskilling team members and establishing AI governance to confidently manage AI adoption. Without this, I've seen the thing happen time and time again: An absence of traceability, guardrails and tools governance—along with the failure to verify the secure-coding proficiency of developers—will lead to high-risk situations with an abundance of vulnerabilities in codebases, resulting in staggering technical debt.​

To address this, start by auditing your entire AI development life cycle (ADLC). In doing this, be sure to prioritize accurate attribution, policy compliance review and the connection of environment signals to governance actions. Such an audit can give greater insights into your team’s AI usage and progress metrics.​

To ensure success, organizational leadership should include the following capabilities and practices in their auditing/continuous improvement programs:​

• Observability: Security leaders must prioritize deep observability in order to assess confidence in the ADLC. They need to capture signals from AI coding tools, large language models (LLMs) and model context protocol servers (MCPs). The latter is essential in helping prevent AI agents from accessing sensitive internal tools or databases through unvetted, risky connections.​

• Training: In upskilling the threat-mitigation capabilities of the humans handling AI, training efforts should correlate developers’ skill sets and their AI usage with vulnerability benchmarks to identify risk levels and enforce policies before code reaches production. With this, developers can automatically receive the most relevant training and build coding proficiency more quickly.​

• Governance: Leaders must align developer teams' security standards with the organization's, ensuring that only approved AI tooling and practices are in place. Readily available governance solutions can help with this by making AI’s influence on software development visible, attributable and enforceable. Enterprises can trace which AI models affect specific commits, correlate that to vulnerability exposure and take corrective action before flawed code reaches production. Ultimately, this allows them to scale AI coding tools with measurable control over software risks.​

I know this approach works; I've had clients install proprietary AI governance software that, within a matter of days, flagged open-source models being used that were not accounted for. This significantly expanded that company’s risk profile before discovery. I believe organizations that remain blind and ignore these best practices will find themselves on a dangerous path.​

It’s clear that the era of AI-assisted coding has arrived, ushering in coding velocity gains that deliver a tremendous boost in developer productivity. But speed without guardrails inevitably creates liabilities, resulting in vulnerabilities and technical debt.​

By implementing policy controls, building unprecedented observability and governance over AI coding tools, LLMs and MCPs influencing codebases, and investing in adaptive learning based upon capabilities assessments and vulnerability benchmarks, organizations can ensure that an AI-enabled development “fast lane” will not come at the expense of insecure code.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?