Minutes to break in, months to fix

Software used to move at the speed of the people writing it.

Software used to move at the speed of the people writing it. That limit is gone. AI now writes nearly half the code running inside major companies. And that code is surging to an unprecedented volume and scale no organisation has ever managed.

Artificial intelligence (Representative)

This problem is only compounding as more and more code ships, and that code carries a higher density of vulnerabilities. We surveyed more than 2,000 security leaders and developers and found that organisations with the highest share of AI-generated code were three times more likely to ship vulnerable code than those with less.

There’s another problem. Speed cuts both ways. Bad actors can weaponise LLM Models to move just as fast. Hackers only need minutes to turn a flaw into a working attack. But it can take months, even years, for organisations to fix the vulnerabilities behind these attacks.

This is unacceptable cyber risk. It’s also downright unsettling when you see where the data is headed. JP Morgan Private Bank’s July 2026 Patchmageddon report says the median time between a vulnerability’s disclosure and its first exploitation has fallen from roughly a year five years ago to about a day today.

Application security is now a top issue for the corporate boards across industries. When code ships faster than security teams can review, the risk isn’t a line item in a technical report. It’s a liability on the level of financial controls or supply chain exposure.

Enterprises need to answer strategic questions about this mounting risk, such as:

• Is our security programme built for the world where AI writes our software, or the one where people did?
• Do we have a comprehensive picture of all of the vulnerabilities in our code?
• Do our security findings get acted on in hours, or do they sit in a backlog?

LLMs are highly effective at finding novel and complex exploits. But they are probabilistic, so outcomes vary, which results in inconsistency. Run the same scan against the same code five times, and the findings match only a third of the time.

A benefit of the systems we’ve built over the past two decades is that they return the same answer every time on the same code. That predictability is vital for compliance.

We need coverage that uses the best of AI and the best of proven security intelligence. Together, they deliver more complete results that you can trust.

Our vision is a hybrid approach that pairs deterministic precision with frontier AI reasoning. This is the architecture behind our latest scanning engines (Fusion and Next-Gen SAST) which combine rules-based precision with the latest frontier AI models. In practice, this dramatically improves identification of potential threats. In fact, the combined approach consistently outperforms AI models working alone, identifying many more potential threats with far greater accuracy.

But discovering problems is just the start. We must prevent vulnerabilities before they exist. One way is to use AI agents at the point of code creation to identify and fix issues before a human even sees them. For the existing backlog, the goal is to automate fixes for the quickest impact with the least effort.

In both cases of finding and fixing threats, AI plays and important role, but it can’t do it alone. The security intelligence we have built over decades is essential to reducing the increasing exposure enterprises face.

None of this is about slowing AI down. The hard truth is that attackers won’t stop and with AI they work faster than ever. That’s why it’s vital for us to work together to secure our future. We’re proud to be a member of Anthropic’s Project Glasswing, a consortium of more than 150 organisations working to protect the world’s most critical software and share our learnings.

AI gave attackers the gift of speed. At Checkmarx, we’re building toward a future where security moves faster than potential threats so there’s no compromise. With deep application security expertise shaped by pioneering research and proven results, we help organisations close the gap between the speed of modern attacks and the speed of effective defence.

Meeting this moment takes more than a tool or a team working in isolation. It’s a decision about how the whole organisation builds software. The companies that make that call now, while the shift is still underway, will spend far less time explaining problems later.

(The views expressed are personal)

This article is authored by Sandeep Johri, CEO, Checkmarx.