AI-Generated Code and the Expanding Application Security Challenge

Hi, I'm Joan Goodchild with CSO, and we are at the CSO Cybersecurity Conference and Awards here in Nashville. And I am pleased today to be joined by Sohail Iqbal, who is the Chief Information Security Officer with Veracode.

He's going to join us to talk about all things AI today as part of this episode of Cyber Sessions. So welcome and thank you very much for being here. Thank you.

Pleasure to be here. Yeah.

And I listened in on some of your presentation earlier, and we're talking about development teams using AI as kind of part of what you discussed.

Are you finding now, because this is a big sort of point of discussion with a lot of different people, but especially in the development team, are more efforts formalized or informal, would you say?

So in every organization, that is kind of a balance which most organizations are trying to maintain. It started somewhere in the shadows and then it becomes formal over a period of time.

But one thing is for sure, I think I was at a Gartner conference two years ago, and they projected somewhere about 90% of the professionals, they are aware of how to use coding assistance, AI coding platforms for personal or professional.

So again, depending on organization, how much controls they have, how much policies they have and what do they allow and what they don't. So, but it is certainly existing in both forms, formal and informal.

Even the people who are informal, they are taking a lead from those coding platforms. Copy paste is working, is very much in documentation. They're taking help.

But nevertheless, as the industry has started to realize that it's inevitable, today we are looking at it from.

So we publish State of Software Security every year, and based on some analysis which we had done with the independent research Institute, anywhere about 60 to 65% of the code which is coming in, it is being helped by or by utilizing this AI coding platform.

So certainly it exists in formal and informal. It's just based on governance, based on policies to each organization, how much of and in what environments they allow it and where. It's still sort of on the sidelines. Okay.

Another big thing that we talk about too, is how much code is being generated. AI generated code in the past year and sort of different initiatives and efforts that are happening, whether they're out in the open or kind of behind the scenes in various organizations.

How do you think from your vantage point that it's affecting software quality? Oh, absolutely.

So look at this way. You know, another part of that research which we publish, what we have seen, is that the code velocity is exponential. It is happening a lot faster. Right.

There used to be a time when you're writing an application in six months or a year, right? Now it's happening in a matter of days and weeks.

So a lot more code is written, but in terms of the flaw density, the vulnerability density, that's pretty much the same as an experienced and secure software developer writing the code. So you're seeing the same density, same flaw. Right.

We have seen also there may be a higher sort of the accuracy from the syntax standpoint, but itself from the flaw perspective is pretty much the same density as a secure software developer is writing.

So that hasn't change, but a lot more code is written. So which means that a lot more vulnerabilities are being observed. Right.

So that, and we are seeing by observing the backlogs which most organizations are carrying, that there is about anywhere about 20% uptick, which we have seen as compared to the last year.

How confident are you in the ability to be able to detect vulnerabilities introduced specifically by AI generated code before they reach production? Good question.

So look, Mythos from Anthropic, very recently, right? They established that, yes, it's very much possible that you identify vulnerabilities and you know, and even the vulnerabilities which were part of the industry from past 20 years and you know, and they went unnoticed.

So the capability of identifying vulnerability is not an issue. But issue is that if you're writing a code at a machine speed, are you able to remediate it also at a machine speed? That's the challenge which the world is facing right now. Scanning, finding, knowing.

Vulnerability means nothing, right? Means you have more obligation, you have a risk on your hand now, which you are obligated to share with your executive management, with your stakeholders, shareholders, all those.

But building a capability, building expertise on remediating that code at the same speed as you're generating code, that's where the balance comes in. And at Veracode, we are very proud of it. We sense this is the direction the market is heading. About two years ago, so were focused.

This is one thing which we did it from the past 20 years. We know what a good code looks like. So we build our own LLM platforms based on curated data sets, supervised learning.

So we focus on that we should enable our customers to remediate it at the same velocity, at the same speed as they are. They have the AI enabling their software development. Life cycle.

It had to be balanced, otherwise you're just going to add more risk and that would undermine the productivity which you're gaining So this is where the industry stands now, meeting that challenge, uplifting themselves, building processes which are machine centric building capabilities which allows them to remediate code at the same pace as they're developing code.

Now you mentioned this already, but obviously the release of Claude's Mythos is a, you know, big moment in this industry and was, you know, kind of all that was talked about for a few weeks there.

How do you see Mythos impacting the industry and what is Veracode doing in response?

So first thing, I'm absolutely not surprised. What Mythos brought to us, I think from personal perspective and from Veracode perspective. We've been talking from past a couple of years or so. We know knew where we are heading.

We saw that if the ability to write the code at a machine speed, at the AI enablement, there's going to be a moment that you have to balance the two sides of the equation.

So we knew that the industry is going to build capability in terms of writing code at that massive scale and the adversaries are also going to take advantage of it writing exploit also at the same speed because now they know those so it so software vulnerability becomes as a new zero day at some point, right?

It is that here's the vulnerability is disclosed and within hours it's weaponized.

So we knew that risk where it's heading the market. So that's why we focus very much building capabilities, enabling our customers, building proactive measures, proactive controls so they are able to get in front of.

That's why we launched our first static code analysis based on for our first party code, Veracode fix, an AI platform which allows you to fix the first party code at a machine speed. Similarly then we realized that 70% of the vulnerabilities are coming out of the open source.

So what exactly we do in terms of that? Then we release a package firewall which prevents vulnerable code becoming a part of your libraries. Then we also release a delay lost RSA and a very good fix for SCA platform for open source.

So you're also able to meet the same challenge at the same velocity, at the same speed as you're generating and writing code or building your application.

So from Mitha's perspective, this is exactly some of the recommendation if you look at the CSA advisory, other advisories which have come along with other traditional controls, the zero trust, the network segmentation, identity controls.

But it also heavily focus on that the two parts, one is risk management, risk prioritization and the second part is using an AI speed to remediate the code. Also I think that's where the baricode is in the picture.

That's where the Veracode focus on from the past couple of years to building that capability. So we are able to meet that challenge.

As developers are relying more on these AI coding assistants. How are you balancing development speed with the need for secure coding standards and accountability?

So good question again, you know, it goes back to the same thing. One is that we had to be. We had to operate at a higher level, right? At a higher layer, right.

You no longer can operate at a vulnerability layer because what we have looked at the backlogs, right. You know, I think 50% of the organization are carrying critical vulnerabilities in their backlog and higher number even for overall the tech debt.

So one thing it really had to understand that what is a risk, right? Not every vulnerability is a risk. So adding a context to the vulnerabilities to identify what is exploitable, what is a true risk which has the potential to compromise and impact the organization.

That's where Vericode we built a platform called brm, very good risk management platform which allows to contextualize those vulnerabilities.

Look in the true perspective, in the true mirror that what is exploitable, what has the potential to impact the organization.

So looking at from that layer, what we did is that we uplifted everything to a finite list of the vulnerabilities which everyone has to go fix in a due time. So that is one ability and capability.

And second, again, providing them higher fidelity, higher confidence fixes out of the AI platforms which enables them to fix them at speed. Because what we have seen or observing is that the buffer for the security is just gone between the production, between the code development to the production.

Right. So how do you and the industry has worked on that model, right. The DevOps came and then very quickly change in DevSecOps. The SEC is the security part has to be tightly integrated.

And this is exactly what we are doing. We are integrating security to the fundamental development of application. It doesn't matter. Before you had the developers writing, now you have the machine writing. But the security is an integral part. It has to live through the life cycle of it.

We are just uplifting it to a high where we are talking about the compliance aspect of it, the assurance aspect of it, the attestation aspect of it. Absolute the risk management perspective that what is the risk and which one has the potential to impact the organization.

So you can focus on what needs to be fixed within the organization rather than a Large scale of the tech debt.

Okay, so as given that 82% of organizations now carry security debt and that remediation capacity is effectively flat, what governance changes do you think that CISO should implement at either the executive or the board level to prevent security debt from compounding year over year?

Yeah, so certainly this is going to be a challenge. Right. The governance has to have a new meaning. When we talk about from risk management perspective, from tech debt perspective, a lot has already been defined.

For example, we talk about the solar wind episode, what came out of it after all that the SEC passed on regulation which says that CISOs are obligated to share the risk with the stakeholders. Your board, your executive management and all just simply. I'm trying to simplify it.

CISOs are responsible for sharing that risk, understanding that risk. So for that they can no longer look at the AppSec or the software development in a separate silo. It has to be looked across the organization. I very often speak internally with my team.

I wrote a blog about it.

The new era of the risk or enterprise risk management is literally I call it A, B, C and D which is A is your app stack. B is your business compliant. Where we talk about for example if you're E commerce you must be PCI compliant.

If you're healthcare you must be high tech or hipaa. Right. Regulation. So similarly C is your computer, right. And D is your data plan, your dsm. So the aggregation of all these signals, right and looking at it from and correlating all those signals, looking for what is.

Because these all four together coming will build the context for you what is an absolute risk that which has a potential to impact the organization. And, and I think you know this is where we, this is the layer where we need to operate. Right.

Rather than chasing the individual vulnerability regardless their risk or not or based on or remediation activities based on the volume is just not going to hold or beneficial for the organization. You have to because you're operating at a high velocity at a much bigger scale.

So you really need to filter the risk at that layer and then attack from that angle that you are addressing what has the potential to impact to your business.

And I think that's the lens which will become critical for all security leaders that they operate from the risk of the, from the risk management and CISOs are risk management professional anyway to begin with and I think that's, that will perfectly enable them to manage those, manage those risks more effectively.

Great.

Well thank you for joining us today. My pleasure.

It was great.

Thank you so much. It was a good conversation. All right.

And thank you for joining us. For now, I'm Joan Goodchild with CSO. We'll see you next time.