“AI will fix security”

Reality: This mistakes a tooling problem for an incentive problem. The solutions to recurring defect classes have existed for decades (see UV-01). What has been missing is liability, procurement pressure, and regulatory consequence, and AI changes none of them.

AI can help with product security. But the question is whether we will repeat the mistakes of the software era at AI speed and scale. The window to get the incentives right is open now. It will not stay open.

Discussion prompts

• What does your team actually base its trust in AI-generated code on?
• What would it take for AI to be a net positive for security rather than an accelerant of the existing problem?
• Is your organization adopting AI to ship fewer defects or to ship faster, and which does the budget reflect?