How AI-generated code impacts application layer security

Jeff Williams:

Yeah. It's not a great time to be an AppSec analyst or a SecOps researcher. Like, it's just it's, it's tough work, and it's not fair. What we're asking those people to do.

It's a very stressful job. They go home. You know, they're trying to protect companies and consumers, and it's not a sustainable situation. So we've gotta do something to change the curve.

 

Jake Milstein: 

Hey, everybody. My name is Jake Milstein. I'm here with the founder of Contrast Security, Jeff Williams. Jeff, good to see you today.

 

Jeff:

Hey, Jake. What's going on?

 

Jake:

Yeah. And I mean, we just heard from the analysts at IDC that in their latest study, I'm not sure whether it's out yet, but ninety one percent of organizations are using AI to help code at this point. So the other side of the text. Right? That they're using AI assistance in some way.

Is that code more secure?

 

Jeff:

Well, no. I mean, there's studies that show that it's not more secure, but I suspect it's roughly equivalent to code that humans create. And that's not surprising because it's trained on code that humans created with lots of vulnerabilities in it. And so, unfortunately, we're not likely to do much better than that at least in the foreseeable future.

And, you know, if you if you created that and you had AI go you know, let's say the AI was twice as secure, half as many vulnerabilities as a human, You know, you're still gonna want the AI to code faster. So don't you just end up with more vulnerabilities in the end, and they're just coming at you faster?

 

Yeah. Even if it was twice as good at security but produced twice the amount of code, you'd still end up with the same net number of vulnerabilities. So it's not really helping.

 

Yeah. It's complicated, but I think AI, you know, using AI to help write code is here to stay. The productivity gains are just too big to ignore, so that's what people are gonna do. So now we gotta adapt to, you know, drinking from an even bigger fire hose.

 

Jake:

One of the things that came out in the last week is the Veracode state of software security report. And, you know, they do this every year and, you know, they come out. They have really, really interesting findings in there. And, you know, it says it's seventy it says seventy percent of orgs are drowning in security debt. It's just it is an unsustainable problem to think that, you know, those orgs are drowning in security debt. And, you know, on the other side, security operation centers are drowning in false positives and the inability to see what's happening in the application layer.

 

Jeff:

Yeah. It's not a great time to be an AppSec analyst or a SecOps researcher. Like, it just it's, it's tough work, and it's not fair what we're asking those people to do. That's a very stressful job. They go home. You know, they're trying to protect companies and consumers, and it's not a sustainable situation. So we've gotta do something to change the curve.

You know, over the last year, I've probably talked to fifty CISOs and a bunch of SOC analysts.

And in most cases, even if they have a WAF and even if that WAF is pumping the data into Splunk or whatever, they're not looking at it because it's so noisy. It's almost impossible to figure out the signal from the noise.

And, also, they have a misunderstanding that, you know, oh, my EDR will find it. You know? Yeah. It might not find it in the very beginning, but it'll find it later. And one of the things that we've found is that eighty percent of AppSec attacks sail right past EDR, and they do not detect it until, frankly, it's way too late, and the data is already being exfiltrated.

 

Jake: 

Alright. Well, Jeff, thank you for joining me today. Folks, we're gonna talk to you again soon. Looking forward to talking to you again on video, Jeff. See you soon.

 

Jeff:

Thanks, Jake.