[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvMUmz9fOI6dMlMrgZEUsie4u-kjEf5NZGGKmlMiEuRk":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"249270f0-1916-4f3f-a053-933b6428ef3a","Shipping More AI Code Than You Can Secure? Watch How to Control Remediation Debt","shipping-more-ai-code-than-you-can-secure-watch-how-to-control-remediation-debt-a17500","If your developers are using AI coding tools, you are probably already seeing the upside: faster development, more code, and less time spent on routine work. The harder part is what comes after. AI can also introduce open-source packages at a pace your security team was never built to handle. More dependencies mean more vulnerabilities to review, more remediation work, and a backlog that can","AI coding tools accelerate development but also introduce open-source packages at an unmanageable pace, leading to increased vulnerabilities and remediation debt. A survey of 300 enterprise leaders reveals how teams are struggling to keep up with AI-driven open-source risk, impacting audit failures, breach frequency, and productivity.","AI coding tools increase open-source package adoption, creating remediation debt for security teams.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fshipping-more-ai-code-than-you-can.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh1E-F55owwrRxUZE2CT3U8U-Ibj1rhbLpTmF0diYP4-uP6clImo12GvOHx7X-W4KPLl1F_OXiXjkRqSjuAOn0Sh6kMjPFbh5c09h4Ua3TNfLI7_P87UrGtuTypzdlpgVAazbD2qXvesRgxLW1cPBkADNMaGDh06-9wPXSVwltxeR7e5ejENDWcHXssP3M\u002Fs1600\u002Fai-webinar.jpg","2026-08-24T11:58:00+00:00","2026-08-24T14:00:05.602407+00:00",7,[17,20,23],{"name":18,"type":19},"AI coding tools","product",{"name":21,"type":22},"open-source","technology",{"name":24,"type":25},"ActiveState","vendor","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":26,"icon":28,"name":29,"slug":30},null,"AI Security","ai-security",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":21},"ade75414-7914-4e23-a450-48b64546ee70","Open Source",[],[24,18],{"controls":46,"vendors":131},[47,76,104],{"slug":48,"name":49,"problem":50,"products":51},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":30,"name":77,"problem":78,"products":79},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"slug":105,"name":106,"problem":107,"products":108},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[109,117,123],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":147},"ai-generated-code-outpaces-security-teams-fueling-remediation-debt","AI-Generated Code Outpaces Security Teams, Fueling Remediation Debt","AI coding tools are introducing open-source dependencies faster than security teams can evaluate, track, or remediate them, creating a growing backlog of unresolved vulnerabilities known as 'remediation debt.' Enterprise teams are failing audits and experiencing higher breach frequencies because the pace of AI-assisted development has fundamentally outstripped traditional vulnerability management workflows. Open-source packages carry inherited risks from their own dependency trees, meaning a single AI-suggested library can introduce dozens of transitive vulnerabilities. Without governance controls on how AI tools select and import packages, organizations are effectively ceding software supply chain decisions to automated systems with no security context. This matters because unmanaged remediation debt compounds over time, making it exponentially harder and more costly to secure systems retroactively.",[137,138,139,140,141,142,143,144,145,146],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-218 (SSDF): Secure Software Development Framework","NIST CSF 2.0 - Identify (ID.RA): Risk Assessment","NIST SP 800-161: Supply Chain Risk Management","OWASP Software Component Verification Standard (SCVS)","SLSA Supply Chain Levels for Software Artifacts","ISO\u002FIEC 27001 A.12.6: Management of Technical Vulnerabilities","GDPR Article 25: Data Protection by Design and by Default","Executive Order 14028: Improving the Nation's Cybersecurity (SBOM mandate)",{"NIST SP 800-161: Supply Chain Risk Management":148,"SLSA Supply Chain Levels for Software Artifacts":149,"NIST CSF 2.0 - Identify (ID.RA): Risk Assessment":150,"CIS Control 7: Continuous Vulnerability Management":151,"OWASP Software Component Verification Standard (SCVS)":152,"CIS Control 2: Inventory and Control of Software Assets":153,"GDPR Article 25: Data Protection by Design and by Default":154,"ISO\u002FIEC 27001 A.12.6: Management of Technical Vulnerabilities":155,"NIST SP 800-218 (SSDF): Secure Software Development Framework":156,"Executive Order 14028: Improving the Nation's Cybersecurity (SBOM mandate)":157},"Supply chain risk management covers open source dependencies added by AI tools.","SLSA helps verify the provenance of components added to codebases.","Risk assessment helps prioritise remediation of vulnerabilities introduced by AI-generated code.","Vulnerability management must keep pace with AI-introduced dependencies to avoid remediation debt.","SCVS provides requirements for verifying components, helping manage AI-introduced dependencies.","A software inventory, including AI-introduced dependencies, helps track what code is in use.","Data protection by design includes secure development practices, even when AI writes code.","Managing technical vulnerabilities requires keeping up with dependencies added by AI tools.","The SSDF calls for vetting third-party components, including those added by AI coding tools.","SBOM requirements help track dependencies, including those introduced by AI tools."]