Oct 5, 2026 · 42 min · 10 segments
AI can build your IAM connector in an afternoon. But was the connector ever the bottleneck? In this episode, Matthias invited Patrick Teichmann, lead advisor at KuppingerCole Analysts, to talk about…
Matthias ReinwarthHostYou used existing sources and compiled them and built them into your advisory node and extended them.
So the thing is, or, or why did I had a closer look on the code quality in terms, for example, of security, yeah, because there are now figures out or is research out from organizations, for example, the Veracode 2026, uh, Gen AI Code Security Report that I actually had a look in, into because a lot of organizations now to rush on the, yeah, uh, deployment of AI without really thinking about the consequences it has, and maybe put too much trust in what it actually produces.
Of course, we know AI can hallucinate and so on, but is this really considered during the implementation or during the deployment? So I wanted to have some foundation to build on my, yeah, my, my, uh, view I have on this.
And the, this report shows actually that only the, there's only a security pass rate of 56%, uh, for across 100 models, yeah? So that means the models produce around 44% of known vulnerabilities, yeah? So on the first hand, this means you cannot directly trust the output, yeah? You still need a proper pipeline around it, yeah? Good security testing, for example, and, uh, like everything you need in a good development organization or engineering organization.
And also specialized models are not better, yeah? They are slightly better, but in general, the pass rates are not that good.
So the conclusion I can draw here is, um, you cannot just trust the code AI produces.
That was also my, my point that I was thinking of because everybody knows where if you, if you give a bad prompt to your LLM, if you give, yeah, too vague instructions, you will end up with something that could look like the solution but surely is not.
So adding proper expertise, so adding the human into, into the human developer, uh, into the loop as well, and with proper, as you said, pipelines, with, with proper regression tests and everything that is required here might still really improve the quality of the code.
So this is, I think, the conclusion we can, we can draw from this, yeah? So AI will not solve a bad software development practice.
And as we know from a lot of organizations who are doing just configuration and customizing and IAM are not applying the same principles, uh, they would apply to normal software development practice because kind of, um, the promise is you're just doing configuration and adjustments and so on.
But, uh, yeah, if now adding AI on this, you might produce, yeah, loopholes in your code, security flaws, and so on.
So yeah, if you don't have this proper practice, then it will be bad news because it will...
You know, or in a lot of discussions we, uh, we hear kind of the term AI amplifies what is already there.
You used existing sources and compiled them and built them into your advisory node and extended them.
So the thing is, or, or why did I had a closer look on the code quality in terms, for example, of security, yeah, because there are now figures out or is research out from organizations, for example, the Veracode 2026, uh, Gen AI Code Security Report that I actually had a look in, into because a lot of organizations now to rush on the, yeah, uh, deployment of AI without really thinking about the consequences it has, and maybe put too much trust in what it actually produces.
Of course, we know AI can hallucinate and so on, but is this really considered during the implementation or during the deployment? So I wanted to have some foundation to build on my, yeah, my, my, uh, view I have on this.
And the, this report shows actually that only the, there's only a security pass rate of 56%, uh, for across 100 models, yeah? So that means the models produce around 44% of known vulnerabilities, yeah? So on the first hand, this means you cannot directly trust the output, yeah? You still need a proper pipeline around it, yeah? Good security testing, for example, and, uh, like everything you need in a good development organization or engineering organization.
And also specialized models are not better, yeah? They are slightly better, but in general, the pass rates are not that good.
So the conclusion I can draw here is, um, you cannot just trust the code AI produces.
That was also my, my point that I was thinking of because everybody knows where if you, if you give a bad prompt to your LLM, if you give, yeah, too vague instructions, you will end up with something that could look like the solution but surely is not.
So adding proper expertise, so adding the human into, into the human developer, uh, into the loop as well, and with proper, as you said, pipelines, with, with proper regression tests and everything that is required here might still really improve the quality of the code.
So this is, I think, the conclusion we can, we can draw from this, yeah? So AI will not solve a bad software development practice.
And as we know from a lot of organizations who are doing just configuration and customizing and IAM are not applying the same principles, uh, they would apply to normal software development practice because kind of, um, the promise is you're just doing configuration and adjustments and so on.
But, uh, yeah, if now adding AI on this, you might produce, yeah, loopholes in your code, security flaws, and so on.
So yeah, if you don't have this proper practice, then it will be bad news because it will...
You know, or in a lot of discussions we, uh, we hear kind of the term AI amplifies what is already there.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
