Editor’s note: The following is a sponsored blog post from QA.
The democratization of software development is accelerating faster than most security teams realize. What once required teams of developers, months of effort and significant technical expertise can now be accomplished through a series of natural language prompts. Applications, workflows, automations, integrations and data pipelines can be generated in minutes rather than weeks.
Skeptics will rightly point to previous waves of no-code and low-code platforms. The difference this time is scale, accessibility and speed. Vibe coding enables almost anyone to build production-ready applications through natural language, compressing weeks of development into minutes. The topic first caught my attention during a discussion with a colleague experimenting with Replit alongside his son.
The productivity gains can be significant for certain products. However, the security implications are only beginning to be acknowledged. Much of the current discussion focuses on whether AI-generated code contains vulnerabilities.
Researchers at RedAccess recently analyzed thousands of applications created using popular vibe coding platforms, including Lovable, Replit, Base44 and Netlify. They identified more than 5,000 applications with little or no security controls or authentication, with nearly 40% exposing sensitive information such as medical records, financial data, internal business documents and customer conversation histories. The issue wasn't malicious intent; it was software being deployed faster than it could be secured.
While this is important, it’s not the most significant challenge facing the CISO. Software has always contained vulnerabilities, despite the persistent shift left, DevSecOps and secure by design collaboration efforts. The more consequential issue is that vibe coding is changing the economics of software creation faster than enterprises can adapt proportionate risk management processes.
For decades, organizations have built security programs around the assumption that software development was performed by skilled engineers operating within structured development lifecycles. Architecture reviews, code reviews, security testing, dependency validation, compliance assessments and deployment approvals were designed around human-led workflows.
Today, business users, product owners, analysts, marketers, operations teams and entrepreneurs can create functional applications with little or no formal software engineering experience. Some of the barriers to software creation are disappearing. Unfortunately, the barriers to creating insecure software have also disappeared.
The fundamental problem is that AI optimizes for functionality, not security. If a prompt asks for a customer portal, booking system or internal dashboard, the model’s primary objective is to generate a working application. Secure architecture, least privilege, threat modeling, input validation and abuse cases are rarely part of that prompt. Unless security is explicitly requested—and then independently verified—the result is often software that works exactly as intended but is not resilient against attack.
The AI security governance gap
Many AI-generated applications are developed outside traditional software engineering teams and beyond established governance processes. Security reviews may never occur and dependencies may never be validated. Sensitive data could be exposed through poorly configured integrations. Authentication, authorization and data protection controls may be implemented incorrectly or overlooked entirely, creating a new generation of shadow development.
The challenge extends well beyond application security. Typically, organizations manage security risk through centralized technology teams, defined development processes and established governance structures. Vibe coding is decentralizing those functions at unprecedented speed. The ability to create software is moving from a relatively small population of software engineers to potentially every knowledge worker within the enterprise.
Every employee is becoming a software developer. Every AI model is becoming part of the software supply chain. Every prompt is becoming a potential source of enterprise risk.
Large language models don’t understand security. They generate statistically likely code, not secure software. Security intent, organizational context, regulatory obligations and risk appetite remain human responsibilities.
Research has repeatedly demonstrated that AI-generated code can contain exploitable vulnerabilities and insecure design patterns, underpinned by a lack of suitable AI governance. More importantly, these vulnerabilities can be replicated at machine scale. The challenge is that many of these weaknesses are not obvious. AI-generated code can successfully pass traditional security and dependency scanning while still containing flaws in business logic, authorization, trust boundaries or application design. Security tools built for reviewing human-written code are not always equipped to understand software generated through prompts and AI-assisted workflows. An insecure implementation generated once can quickly become an insecure implementation generated thousands of times.
A longer-term concern I have is the emergence of an AI vulnerability cycle. As more AI-generated code is published to public repositories, future coding models may increasingly learn from software that has never been properly engineered or security tested. Insecure patterns risk being repeated, amplified and embedded into the next generation of AI-assisted development. At the same time, attackers are learning from the same code and using AI to identify and exploit those weaknesses at scale. The risk is not simply that AI generates vulnerable software. It is that AI could accelerate the creation, reuse and exploitation of insecure code faster than the industry can secure it.
The implications extend beyond cybersecurity
As organizations increasingly rely on AI-generated applications to support business operations, customer engagement, supply chains and decision-making processes, software governance becomes a strategic business issue rather than simply a technical one. Poorly governed AI-generated systems can create exposure, operational disruption expansive technical debt and systemic AI risk. For boards and executive leadership teams, this will become a broader security governance issue rather than a technology challenge.
The software supply chain implications are equally significant. Modern vibe coding environments increasingly rely on a complex ecosystem of models, agents, connectors, APIs, MCP servers, plugins, skills and third-party dependencies. Most organizations lack visibility into which AI systems are contributing to software creation, what components are being introduced or what risks those components carry.
Traditional software supply chain security is focused on source code and dependencies. AI-enabled development and vibe coding introduces an entirely new supply chain that requires AI security governance. This is why security leaders must begin thinking beyond DevSecOps and toward what could be described as AgentSecOps. This is less about replacing DevSecOps than extending it to govern AI agents, prompts, models and autonomous development workflows.
Organizations need security controls capable of operating directly within AI-enabled development environments. Vulnerabilities, prompt injections, insecure coding patterns, malicious dependencies and unauthorized actions must be identified before generated code enters production pipelines. We can’t rely on the LLMs to identify and correct their own security weaknesses (not today anyway). Instead, automated guardrails need to be embedded directly within AI-enabled development workflows, validating prompts, generated code, agent interactions and dependencies before they become executable actions.
Equally important is visibility
Most organizations cannot accurately answer a simple AI assurance question: Which AI models, agents, MCP servers, tools and third-party services are currently contributing to software development?
Without visibility, governance becomes impossible. Just as Software Bills of Materials (SBOMs) became essential for managing software supply chain risk, AI-enabled development requires AI Bills of Materials (AI BOMs) that continuously inventory the models, agents, tools, connectors and dependencies participating in software creation. This visibility provides the foundation for governance, risk assessment, compliance and incident response in AI-driven environments. As I’ve stated many times, AI agents are becoming a new digital workforce. Like human employees, they require oversight, accountability, monitoring, access controls and governance.
The objective is not to slow innovation
The productivity benefits of AI-enabled development are too significant to ignore, and attempts to prohibit their use are unlikely to succeed. The organizations that thrive will be those that implement governance and security controls that operate at the same speed as AI itself. Yes, that ‘speed and safety’ vibe again.
Vibe coding represents one of the most significant shifts in software development since the emergence of cloud computing. Like every major technology transition, it creates new opportunities and new risks. The central challenge for cybersecurity leaders is no longer preventing insecure code from being written. It’s preventing insecure software from being generated faster than it can be governed, understood and secured.
AI hasn’t simply changed how software is written. It has changed who can create it, how quickly it can be deployed and how much enterprise risk can be introduced with a single prompt.
For CISOs, the challenge is no longer securing software written by developers. It is governing software generated by an AI-enabled workforce operating at machine speed.
The organizations that succeed won’t be those that slow AI adoption. They’ll be the ones that build AI governance, security and assurance that can keep pace with AI-driven software creation.
