CISO Guidance for Securing AI-Assisted Software Development

Summary

JFrog field CISO Paul Davis advises tracking AI agents and software components across development and production, using approved package sources, prioritizing vulnerabilities with application context, and retaining human review for operationally risky changes.

Key points

• AI coding tools increase the volume and pace of software changes, making visibility across development, CI/CD pipelines, and production more important.
• Security teams should track which people and agents download software, what they access, and whether their activity is recorded.
• Approved package sources and agreed controls can help agents avoid unreviewed components while allowing experimentation.
• Prioritize vulnerabilities based on whether they affect an organization's software, the application's role, and the operational impact of patching—not severity scores alone.
• Automate initial vulnerability assessments, but retain human judgment for decisions involving service disruption, testing, or change windows.
• Maintain a current inventory connecting applications, components, risk profiles, and release histories.
• Coordinate security, development, and compliance teams through role-specific training and shared processes.

People