For six months, I built a medium-sized, complex application almost entirely with AI assistance – using Claude Opus 4.8 and 5, embedded in a Secure SDLC. Scope: client application, client website, and AWS infrastructure including CloudFront, WAF, load balancers, APIs, and PostgreSQL → AWS RDS as a Managed Database Service.

The Setup

No model was simply allowed to “do its thing”. Defined roles, skills, mandatory rule sets – and a required security gate for every pull request: an independent review by a model from a different provider, ChatGPT Codex, checked against → OWASP Top 10 and OWASP API Security Top 10 → OWASP ASVS as a reference for security requirements and verification → authentication, authorization, session handling, security logging, error handling → IDOR, CSRF, XSS, SSRF, token replay, enumeration, rate-limit bypass

The result (June 2026): 653 reviewed pull requests · 2,258 findings · Ø 3.5 per PR
Peak week: 696 findings, including 120 P1 (high) and 576 P2 (medium).

Review Results

Review Results

Three Observations

  1. The generating model does not reliably identify its own vulnerabilities. A significant share of these findings would never have been detected without an independent second review.
  2. Fixes introduce new vulnerabilities. Addressing reported findings regularly resulted in new ones – without regression reviews, these make it into production.
  3. Without guardrails, an autonomous development process does not meet common security standards. Speed is not an indicator of quality.

My Most Important Learning: AI Is the Enabler of the Security Process.

The same models that generate insecure code can support the security process – once they are used against each other and evaluated against a defined set of rules. The risk can be turned into an opportunity: compliance processes can be supported while the code is being written, and a secure development process can be implemented largely autonomously. There is no such thing as a perfect result – but a highly cost-effective, secure, and fast one is possible.

For CISOs and Compliance Professionals

AI-generated code is not reviewed code. Organizations that allow AI-assisted development need an enforceable gate in the merge process, traceability against a recognized standard, and a measurable history of findings. This is exactly the kind of evidence required in an audit.

For Developers, Especially Juniors

Do not rely on either the model’s self-review or its implementation of security requirements. The code may compile and look clean – and still be insecure.

My View

Using AI-driven processes to enable security is an opportunity to relieve pressure on security teams and developers facing resource constraints. Now is the time to bring the same speed to security.