Four Steps CISOs Can Take To Secure AI-driven Software Development

The debate over whether generative AI should be used to develop software is effectively over. After two years of rapid adoption, AI-generated code has become an established part of enterprise software development.

The more pressing question for chief information security officers (CISOs) is how to maintain security and regulatory compliance as generative AI, and increasingly autonomous AI agents, take on a greater share of software development.

As organisations seek to capitalise on the productivity gains offered by generative AI, while also embracing the capabilities of Model Context Protocol (MCP), a four-point framework is emerging to help manage the associated risks.

The framework provides enterprises with a practical foundation for embedding security and compliance into software development, both today and as AI-generated code becomes more prevalent.

AI-powered coding tools can deliver substantial productivity benefits, however their impact on software quality and security depends heavily on how they are deployed and governed.

Developers equipped with strong security skills and operating within a clearly defined framework can harness AI to produce more accurate, secure code from the outset. This potentially delivers significant improvements in development efficiency and software quality.

Conversely, organisations that adopt AI coding tools without appropriate safeguards risk introducing vulnerabilities at an unprecedented scale. Rather than accelerating secure software delivery, they could find themselves facing a growing backlog of security flaws, rising remediation costs, and greater compliance exposure.

For CISOs, the priority is therefore shifting from controlling the adoption of AI coding tools to establishing the architectural principles, governance controls, and development practices needed to use them securely.

The risks of AI coding are on the rise

Ever since GenAI became a readily accessible tool for an array of business and personal tasks, with the release of ChatGPT in November 2022, quickly followed by other large language models (LLMs), its suitability for code generation has been a hot topic.

Almost immediately, developers began working with GenAI to some degree, and both sides of AI's double-edged sword soon became apparent.

The productivity boost was immediately clear while some early studies determined that AI-generated code was as secure (or even more secure) than code generated by humans.

However, that still left plenty of room for error as human developers are far from perfect either. The real risk was how often and how quickly those errors could propagate into production software.

Achieving secure AI-generated code

Having a framework for secure use of AI coding tools isn't a final destination, but rather a starting point that organisations can adopt now. Gartner offers a four-phase roadmap to achieve this:

• Phase 1: Address your cybersecurity debt.
• Phase 2: Strategically expand existing cybersecurity controls.
• Phase 3: Extend controls to AI-specific requirements.
• Phase 4: Develop a forward-looking plan to secure the future use of AI.

The rules of the road

Developers need clear guidance on using AI coding tools. Having a list of trusted LLMs, together with a list of appropriate tools, is a good starting point. These tools should focus on foundational security best practices and the observability and traceability of developer security skills.

Organisations must focus on the security efficacy of the AI tools they use, ensuring that they are built to meet the demands of a secure environment.

For example, developers need to be able to leverage AI tools for developer-led threat modelling, not just code output. The right AI tools, used the right way, can enhance security while also preventing many errors from slipping into the pipeline.

Good governance is also vital as a lack of visibility and governance can breed 'shadow AI' and the spread of insecure code. A tool that provides deep observability into the AI tools in use and MCPs being utilised can enable organisations to effectively manage AI adoption.

Upskilling developers via an ongoing learning program can help to ensure safe and secure use of AI early in the software development lifecycle (SDLC), allowing organisations to innovate faster and more securely.

Meanwhile, CISOs can empower their developers through educational programs that provide hands-on, real-world upskilling in secure coding. They can also measure their progress in acquiring new skills and observing their commits to see how well they apply those skills on a daily basis, including their ability to check the work of AI tools.

Using benchmarks to establish the required skills and measure educational progress helps organisations effectively manage their use of AI in software development.

AI coding tools such as GitHub, Copilot, and Cursor are rapidly becoming embedded in software development, driving productivity gains and accelerating innovation across virtually every industry.

However, their widespread adoption also reinforces the need to make security a fundamental part of the software development lifecycle, rather than an afterthought.

For organisations seeking to maximise the benefits of AI-assisted development without compromising security or compliance, adopting a four-point framework provides a practical starting point.