Security leaders polled for ArmorCode say their trouble starts after a scanner flags a flaw
Just over half of 200 senior leaders polled for ArmorCode say they will struggle to simplify software security if they keep working the way they do. AI is adding to the pile from both ends, since developers write code faster and scanners find more weaknesses.
The Watch · Security desk
What happened
- Forty percent picked the volume of AI-generated code waiting for human review as their significant software-security challenge.
- The top worry was a flood of low-context alerts that flag a weakness without saying whether it is reachable, exploitable, tied to a business service, or owned by anyone.
- The leading goal was better remediation across security and development teams, and every answer offered on that question involved acting on findings.
- A 44% share named a tiered strategy for AI-assisted vulnerability discovery as their biggest transformation need.
Why it matters
- Who's exposed exposure Every delay between a scanner's flag and a shipped fix leaves a known flaw open longer, so how fast a team triages and routes findings sets how long an attacker gets.
- What it limits constraint Handing reachability and exploitability calls to agents creates audit work, because Chapman says those judgment calls need strong guardrails for auditability and review.
- Who has to decide decision Cutting tools turns into a triage question: Chapman would merge tools that overlap and produce undifferentiated findings, and keep those with unique coverage or high signal quality.
One finding can begin in a scanner, pull context from several other systems, get ranked by the security team, and end up with a developer, a cloud engineer or an outside vendor [9]. Every handoff that runs in its own workflow loses context and time [9]. In Verizon's 2026 Data Breach Investigations Report, the median critical vulnerability takes 43 days to be fully fixed [3]. That is a little over six weeks [19] between the defender finding the flaw and closing it.
The 40% figure on AI-generated code is the weakest number in the survey. Each respondent picked one answer from a short list. That means the figure shows only that AI code review beat the other options for those people, and it says nothing about how the other 60% rate the problem [5]. Counted in people, that is about 80 of the 200 [20].
Help Net Security, which reported the results, wrote that AI-generated code is not inherently insecure but that there is more of it than human reviewers can keep up with [22]. The poll records what leaders think [1]. It does not measure review queues, how fast teams clear them, or whether either has changed over time.
Rob Chapman is a principal solutions engineer at ArmorCode, the company the poll was run for [17][1]. He proposed splitting findings across three tiers. "Automation should handle deterministic work: findings, remediations, and mitigations that are repeatable, low risk, and well understood," he told Help Net Security [11].
The middle tier goes to AI agents. "They can assess signals for reachability and exploitability, identify correlated findings, and surface potential attack paths," Chapman said [12]. Reachability and exploitability are two of the gaps in the low-context alerts that respondents ranked as their top worry [6].
People keep the final calls. "Humans own decisions and their consequences, including risk acceptance and exceptions," Chapman said [14]. "The goal is not to remove people from the loop, but to reserve their limited time and attention for decisions that require good judgment and accountability," he said [18]. Findings that do reach a person should be reviewed "for opportunities to push similar work back down the stack," he added [15].
What to watch
- Release of ArmorCode's full questionnaire and answer options, which would show what the 40% AI-code-review pick was ranked against.
- Verizon's next Data Breach Investigations Report median for fully resolving critical vulnerabilities, as an outside check on whether faster triage shortens the window.
- Published time-to-remediate figures from teams that hand reachability and exploitability triage to AI agents.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ArmorCode polled 200 senior security and technology leaders; just over half say their organizations will struggle to simplify their software security programs if they keep working the way they do today.
- [2]
Most respondents are at companies with 10,000 or more employees, and their worries center on what happens after a scanner flags something.
- [3]
Verizon's 2026 Data Breach Investigations Report puts the median time to fully resolve a critical vulnerability at 43 days.
- [4]
Forty percent of respondents picked the amount of AI-generated code waiting for human review as their significant software-security challenge.
- [5]
Each respondent picked one answer from a short list, so the 40% figure shows that AI code review beat the other options for those people and says nothing about how the remaining 60% rate the problem.
- [6]
The top pick for what keeps leaders up at night is a flood of low-context alerts: warnings that flag a weakness without saying whether anyone can reach the affected system, whether it can realistically be exploited, which business service depends on it, or who should deal with it.
- [7]
Respondents' leading goal was better remediation across security and development teams, and every option on that question involved acting on findings.
- [8]
44% of respondents named a tiered strategy for AI-assisted vulnerability discovery as the biggest transformation need.
- [9]
A finding might start in one scanner, need context from several other systems, get prioritized by security, and land on a developer, a cloud engineer or an outside vendor; each step that runs in a separate workflow costs context and time.
- [10]
Each delay in the chain from flag to fix leaves a known flaw open longer.
- [11]
"Automation should handle deterministic work: findings, remediations, and mitigations that are repeatable, low risk, and well understood,"
- [12]
"They can assess signals for reachability and exploitability, identify correlated findings, and surface potential attack paths,"
- [13]
"Because this work involves judgment calls, it needs strong guardrails for auditability and review."
- [14]
"Humans own decisions and their consequences, including risk acceptance and exceptions."
- [15]
"Ideally, this is a layered approach in which findings that reach humans are reviewed for opportunities to push similar work back down the stack."
- [16]
"I'd consolidate where tools overlap in function and produce undifferentiated findings. I'd keep tools that offer significant depth or unique coverage, and connect the ones that pass this test through the common layer." He also asks of each tool whether its signal quality is high.
- [17]
Rob Chapman is a principal solutions engineer at ArmorCode.
- [18]
"The goal is not to remove people from the loop, but to reserve their limited time and attention for decisions that require good judgment and accountability,"
- [19]
43 days is a little over six weeks.
- [20]
About 80 of the 200 respondents picked AI-generated code awaiting human review.
- [21]
AI tools let developers write and change software faster, and AI-assisted scanning turns up more weaknesses.
- [22]
AI-generated code is not inherently insecure, but there is more of it than human reviewers can keep up with.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- helpnetsecurity.comAutomation, AI agents or people? Sorting out who handles each security finding
1 article · October 6, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.