Cycode Survey Finds AI Coding Adoption Outpacing Product Security Visibility and Governance
Report discovered via Awesome Annual Security Reports.
Summary
Cycode’s 2026 report, based on an October 2025 survey of 400 security leaders in the UK and US, finds widespread AI coding-tool use alongside limited visibility and governance, increased reported security risk, and plans to consolidate AppSec tools.
Key points
- In Cycode’s survey, 97% of organizations were using or piloting AI coding assistants, and all respondents reported AI-generated code in their codebase.
- Only 19% of respondents said they had full visibility into where and how AI was used; 65% reported increased security risk since adopting AI.
- The report found that 52% of organizations lacked a formal or centralized framework for governing AI adoption.
- Respondents identified AI-generated code vulnerabilities, AI tool use, and software supply chain risks as leading security blind spots.
- Nearly all surveyed organizations (99%) reported some product security coverage, while the report describes responsibilities spanning application security, cloud, supply chain, and APIs.
- The survey found that 97% of organizations planned to consolidate application security tools within the next 12 months.
Article Details
- Publisher
- Cycode
- Report Period
- Survey conducted October 2025; report year 2026
- Scope
- Vendor-agnostic survey of security leaders across the UK and US on AI adoption and product security.
- Sample Size
- 400 security leaders
- Key Statistics
- 100% of respondents reported AI-generated code in their codebase.
- 97% of organizations were using or piloting AI coding assistants.
- 19% reported full visibility into where and how AI was being used.
- 65% reported increased overall security risk since adopting AI.
- 52% lacked a formal or centralized framework for governing AI adoption.
- Recommendations
- Provide developers with education and enablement for secure AI development.
- Integrate security checks into AI workflows and coding assistants.
- Use governance and controls to improve visibility and accountability for AI use.
- Expand traditional SBOM practices to include AI Bills of Materials (AIBOMs).
People
Chris HughesQuoted in the report about governance of AI coding tools; identified as affiliated with Resilient Cyber.Francis OdumQuoted in the report about converged security platforms; identified as Founder and CEO of Software Analyst.Katie NortonQuoted in the report about application security risks from AI adoption; identified as Research Manager at IDC.Lior LevyCycode CEO who wrote the report foreword.
Countries
United KingdomCycode commissioned an independent, vendor-agnostic survey of 400 security leaders — including CISOs, AppSec Directors, and DevSecOps managers — across the UK and US.United StatesCycode commissioned an independent, vendor-agnostic survey of 400 security leaders — including CISOs, AppSec Directors, and DevSecOps managers — across the UK and US.