Veracode

I was at SmartBear Software for a while, which is all around automated testing and QA.

And then I went to Veracode after that.

That was kind of a nice transition from automated testing to automating security testing.

And

It had to have been 15 years ago at this point, but they were talking about the code review process.

how many lines of code like developers could review in a manual code review session right and you know per hour or whatever it is and it was partially we were teaching manual code review from a security perspective and so they had this article that we referenced i mean yeah every time that we taught the course because it was like you know four to five hundred lines of code per hour is kind of that that maximum of what what people can actually consume at any given time.

So it's a very difficult prospect when it comes to something like Veracode or what Dry Run is doing from a, you know, you're analyzing millions of lines of code.

There's no way that a human can actually do that.

And naturally, I feel like people are just going to reach for large language models as a coding solution to this problem.

And knowing some of the research that had been presented from Veracode and sort of continuously updated around the consistent 44% rate of new vulnerability introduction in AI generated code made me wonder, you know, how capable is it of maybe editing existing code rather than building something new, like from like whole cloth? Yeah.

and uh yeah what we found out was certainly some interesting results that i think changed a lot of people's opinions on what it's capable of today

i i feel like that that was the common answer was to just use ai to solve ai problems right like ai is generating all this stuff the only way to really fix it is to just embrace it and go with it which is also a scary thought but what did you expect to find after doing all this research

And how many times do you have to do that until you get like a fully clean code base is going to be an outstanding question that a lot of people are going to have to ask.

What improvements would you think need to happen before organizations can start trusting these AIs for vulnerability remediation?

I mean, a few things that we're thinking of right now is, and Chris Weisopel is quoted from Veracode.

He is one of the founders, and I think he's now chief security evangelist over there at Veracode.

Now, when it comes to code, there's lots of code out there that would be considered AI slop.

Actually, Veracode's 2026 security report found that roughly 44% of AI code generation tasks introduced a real exploitable vulnerability.

The average security pass rate across models tested was 56%.

But in the same period, AI-assisted developers were committing code three to four times faster than everyone else.

Obviously, that's kind of a silly statement to a degree because you can, you know, they set up these sessions where people can come and they can like learn about your product and all this kind of stuff.

I know that because the one thing that I can say is like, I actually did a presentation with Veracode because, you know, now Dry Run Security, our company has partnered with Veracode.

They kind of realized that Not kind of like their customers are realizing like, hey, like we need to modernize.

And so Verico needs an answer for that.

Is it?

I mean, I think both between the research that we've published as well as research coming out of Veracode and others, we're working with the University of Alabama's High Performance Computing Center as well to do some tests, basically, or what are they called now? Is it an M? Anyway, I can't remember the name, I'll come back to it.

But we're doing some runs right now just to determine what does the scale look like in terms of reproduction rate of vulnerabilities over time, given what we know from Veracode's research earlier this year, as well as our own research.

And effectively, their runs currently show that we have an exponential runaway of vulnerabilities being introduced by AI in all likelihood, at least given current research and numbers that we've seen.

So I think it's a really great job description for security professionals who are going to have to sit there and address these problems.

And yeah, mythos was on everyone's mind.

You know, the wave of vulnerabilities or tsunami, as some people are calling it, was one of those things that I think all of us were pretty concerned about.

And given some of the research from Veracode, where they just had their spring update on Gen-AI code security and the introduction of vulnerabilities as sort of a consistent 50-ish percent rate for net new code in their study.