AI Changes the Pace, Not the Responsibility

Originally published on LinkedIn on August 30, 2026. Republished here for the HapDo archive.

Some things stay the same, and some things change.

I’m a late bloomer in the field of AI and security. I took a sabbatical after the sale of Devici to play on my farm and plant a garden. What a time to take a break! I came back to a whole new world where coding agents have taken over development.

AI changes the pace of development, not the responsibility.

As AppSec folks, we are still responsible for the security and privacy of the code that goes into our products. It’s just different now.

With this brave new world, there is more tension between faster software delivery and continued human accountability. Agents increase the velocity of code deployments and pull requests. As humans, we’ll fight to stay in the loop, but we have to find a way to do this without squashing that velocity.

This is the same problem security has always faced. There has always been tension between security and development because security wants to slow things down while developers want to build cool stuff. The AI part of the equation cranks up the pace at which security must excel to keep up.

If we try to slow this thing down, we’re going to lose. Five years from now, AppSec could be something that used to be part of development but got squashed because it couldn’t keep up.

Coding agents can operate with meaningful autonomy now. We can act like they can’t, but the reality is that they don’t stop and ask for confirmation on everything they do. And they shouldn’t, because that would make them nowhere near as useful.

This is why we need to know what an agent was allowed to do—and what it actually did. We need a control that sits between the agent and the world so that, at a minimum, we can audit its actions. Ideally, we can block its actions as well.

Visibility into permissions and actions matters if we want to call what we’re doing “secure development.”

At this stage, treat agent-generated code as an untrusted contribution to your repository. Every agent-authored change should arrive with evidence, and that evidence should determine the review it needs.

People use the terms “intern” or “junior developer” to describe how they see an agent today. We wouldn’t let an intern push to production on their first day. We would guide them through the process, but we would conduct a serious code review of their pull request.

AI output still requires validation, review, and clear ownership.

We want to move fast. That is not in doubt. But speed without verification accelerates security debt.

We’ve been racking up security debt with human teams for decades. In this new world, we can use these evolving tools to clear our security backlogs. The catch is that we can’t just turn them loose and hope for the best.

Hope is never an executable plan.

Productive automation is our path forward. The tools that work will create a partnership between development, security, and AI.

DevSecAI? Dare I try to coin a new term in an industry buried in four-letter acronyms? DevSecAI could give us a faster path to reducing the backlog—but its success depends on one principle: no delivery should go unverified.

Our responsibility as AppSec pros remains the same as it was five years ago. Ensure that secure code makes its way to production, and that insecure code is fixed before it goes. The speed has changed, but the tooling we have to support the mission has changed as well. Let's get after figuring out how to tame this new machine!