AI Code Security Demands More Than an LLM
More Code, More Pressure on Security
AI code security is becoming a boardroom concern, not just a developer task. Coding assistants are accelerating software production. Meanwhile, attackers can use powerful models to discover weaknesses and develop exploits.
Checkmarx CEO Sandeep Johri examines that collision with Mike Vizard. Johri describes rising anxiety among security leaders as new code compounds existing vulnerability backlogs. Finding problems is no longer enough. Teams also need practical ways to prioritize and fix them.
Combining AI with Deterministic Testing
Johri argues that large language models bring valuable security capabilities, but cannot provide comprehensive coverage alone. Their findings can vary across models and prompts. False positives and operating costs also complicate enterprise adoption.
The discussion explores a hybrid approach to AI code security. Johri describes Checkmarx Fusion, which combines deterministic scanning with multiple language models. The goal is to broaden detection while filtering duplicate findings and false positives.
Rather than choosing between established testing and AI, he makes the case for using both. Deterministic engines provide repeatable analysis. Models can help uncover additional weaknesses and explore complex attack paths. Johri positions that combination as a way to improve coverage without relying entirely on probabilistic results.
Prevent New Flaws and Reduce Existing Debt
The conversation then shifts from discovery to developer workflows. Johri advocates checking generated code before it enters a repository. He describes Checkmarx DevAssist as a security plugin that works within AI coding environments.
Existing vulnerabilities require a different response. Johri explains how agents can prioritize findings, prepare fixes and return proposed changes through pull requests. Developers remain responsible for reviewing those changes. This approach aims to reduce manual effort without separating security from everyday development.
Workflow integration also matters for collaboration. Johri sees an opportunity to ease friction between teams when security tools help developers fix issues earlier. He argues that useful controls should fit established processes rather than force developers into another interface.
Security remains an ongoing effort as models, applications and threats evolve. The interview closes with a practical direction: prevent avoidable flaws, tackle accumulated debt and keep improving defenses.
